pdfnative-mcp

Annotate PDF (markup / drawing)

annotate_pdf

Idempotent

Append sticky notes, highlights, shapes, free text, and links to PDFs as a non-destructive incremental update, preserving original bytes and keeping covered text extractable.

Instructions

Append markup annotations (ISO 32000-1 §12.5) to an existing PDF as a non-destructive incremental update (original bytes preserved). Types: text (sticky note), highlight | underline | strikeout | squiggly, square | circle, line (needs start/end), freetext, link (needs url — http:, https: or mailto:; the rect is the clickable area). Each needs a 0-based page and rect [x1,y1,x2,y2]; optional contents, color, opacity, title and type-specific fields. VISUAL OVERLAY ONLY — nothing is removed or redacted (covered text stays extractable). Encrypted sources → ENCRYPTED_SOURCE (decrypt_pdf first).

Input Schema

Name	Required	Description	Default
`pdfBase64`	Yes	Base64-encoded source PDF to annotate.
`outputMode`	No	'base64' (default) returns the PDF inline; 'file' writes it inside the PDFNATIVE_MCP_OUTPUT_DIR sandbox (SECURITY_VIOLATION when the sandbox is not configured).	base64
`outputPath`	No	Required when outputMode='file'. Relative path inside the sandbox; must end with .pdf (no absolute paths, no '..').
`annotations`	Yes	Markup / drawing annotations to add. Each is attached to a 0-based page index.

Output Schema

Name	Required	Description
`url`	No	Public URL of the file (file mode, only when PDFNATIVE_MCP_OUTPUT_BASE_URL is set): base URL + sandbox-relative path, percent-encoded.
`mode`	Yes
`summary`	No	Tool-specific summary, when produced.
`filePath`	No	Sandboxed absolute path (file mode).
`sizeBytes`	Yes
`diagnostics`	No	Engine diagnostics (when includeDiagnostics=true).

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedv1.8.0Nov 3, 2026

changedInput schema / properties / annotations / items / properties / type / enum

Previous value: -[
-  "text",
-  "highlight",
-  "underline",
-  "strikeout",
-  "squiggly",
-  "square",
-  "circle",
-  "line",
-  "freetext"
-]New value: +[
+  "text",
+  "highlight",
+  "underline",
+  "strikeout",
+  "squiggly",
+  "square",
+  "circle",
+  "line",
+  "freetext",
+  "link"
+]

addedInput schema / properties / annotations / items / properties / url

Added value: +{
+  "description": "type='link' (required): target of the /URI action — http:, https: or mailto: only, no control characters. The `rect` is the clickable area; no visible appearance is drawn.",
+  "maxLength": 2048,
+  "minLength": 1,
+  "type": "string"
+}

changedOutput schema / description

Previous value: -"Result of a PDF-producing tool. base64 mode: the PDF arrives as an embedded `resource` content block (not duplicated here); file mode: `filePath`."New value: +"Result of a PDF-producing tool. base64 mode: the PDF arrives as an embedded `resource` content block (not duplicated here); file mode: `filePath` (and `url` when the operator maps the sandbox to a public base URL)."

addedOutput schema / properties / url

Added value: +{
+  "description": "Public URL of the file (file mode, only when PDFNATIVE_MCP_OUTPUT_BASE_URL is set): base URL + sandbox-relative path, percent-encoded.",
+  "type": "string"
+}

Changed3 schema fields changedv1.6.2Sep 27, 2026

changedInput schema / properties / annotations / items / properties / color / oneOf

Previous value: -[
-  {
-    "description": "Hex (e.g. \"#ffcc00\") or PDF operator string (\"R G B\").",
-    "type": "string"
-  },
-  {
-    "description": "RGB tuple, 0.0–1.0.",
-    "items": {
-      "type": "number"
-    },
-    "maxItems": 3,
-    "minItems": 3,
-    "type": "array"
-  }
-]New value: +[
+  {
+    "description": "Hex (e.g. \"#ffcc00\") or PDF operator string (\"R G B\", or \"C M Y K\" for DeviceCMYK), each operand 0.0–1.0.",
+    "type": "string"
+  },
+  {
+    "description": "RGB tuple, 0.0–1.0.",
+    "items": {
+      "type": "number"
+    },
+    "maxItems": 3,
+    "minItems": 3,
+    "type": "array"
+  },
+  {
+    "description": "DeviceCMYK ink percentages [c, m, y, k], each 0–100.",
+    "items": {
+      "maximum": 100,
+      "minimum": 0,
+      "type": "number"
+    },
+    "maxItems": 4,
+    "minItems": 4,
+    "type": "array"
+  }
+]

changedInput schema / properties / annotations / items / properties / interiorColor / oneOf

Previous value: -[
-  {
-    "description": "Hex (e.g. \"#ffcc00\") or PDF operator string (\"R G B\").",
-    "type": "string"
-  },
-  {
-    "description": "RGB tuple, 0.0–1.0.",
-    "items": {
-      "type": "number"
-    },
-    "maxItems": 3,
-    "minItems": 3,
-    "type": "array"
-  }
-]New value: +[
+  {
+    "description": "Hex (e.g. \"#ffcc00\") or PDF operator string (\"R G B\", or \"C M Y K\" for DeviceCMYK), each operand 0.0–1.0.",
+    "type": "string"
+  },
+  {
+    "description": "RGB tuple, 0.0–1.0.",
+    "items": {
+      "type": "number"
+    },
+    "maxItems": 3,
+    "minItems": 3,
+    "type": "array"
+  },
+  {
+    "description": "DeviceCMYK ink percentages [c, m, y, k], each 0–100.",
+    "items": {
+      "maximum": 100,
+      "minimum": 0,
+      "type": "number"
+    },
+    "maxItems": 4,
+    "minItems": 4,
+    "type": "array"
+  }
+]

changedOutput schema / properties / diagnostics / description

Previous value: -"PDF/A diagnostics (when includeDiagnostics=true)."New value: +"Engine diagnostics (when includeDiagnostics=true)."

Changed6 schema fields changedAug 24, 2026

addedInput schema / properties / outputMode / description

Added value: +"'base64' (default) returns the PDF inline; 'file' writes it inside the PDFNATIVE_MCP_OUTPUT_DIR sandbox (SECURITY_VIOLATION when the sandbox is not configured)."

addedInput schema / properties / outputPath / description

Added value: +"Required when outputMode='file'. Relative path inside the sandbox; must end with .pdf (no absolute paths, no '..')."

changedOutput schema / description

Previous value: -"Structured result of a PDF-producing tool. In base64 mode the PDF bytes are delivered out-of-band as an embedded `resource` content block (data: URI), NOT duplicated here, to keep responses token-frugal. In file mode `filePath` is the sandboxed absolute path."New value: +"Result of a PDF-producing tool. base64 mode: the PDF arrives as an embedded `resource` content block (not duplicated here); file mode: `filePath`."

addedOutput schema / properties / diagnostics

Added value: +{
+  "description": "PDF/A diagnostics (when includeDiagnostics=true).",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "code": {
+        "type": "string"
+      },
+      "message": {
+        "type": "string"
+      },
+      "severity": {
+        "enum": [
+          "warning"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "code",
+      "message",
+      "severity"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedOutput schema / properties / filePath / description

Previous value: -"Absolute sandboxed file path (when mode='file')."New value: +"Sandboxed absolute path (file mode)."

addedOutput schema / properties / summary

Added value: +{
+  "additionalProperties": true,
+  "description": "Tool-specific summary, when produced.",
+  "type": "object"
+}

Addedv1.4.0Jul 5, 2026

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safety profile (readOnly=false, destructive=false, idempotent=true), and the description reinforces it with valuable detail: incremental update with original bytes preserved, covered text stays extractable, and link rects draw no visible appearance. Minor tension: 'append' semantics mean repeat calls would stack duplicate annotations, which sits awkwardly with idempotentHint=true, though the description never claims call-level idempotence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The key constraint (non-destructive, original bytes preserved) is front-loaded and the type list is compact. The middle run-on sentence packing types, requirements, and encodings is dense but every clause carries information; only light reformatting would improve scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, all four parameters are documented, and annotations cover the safety profile, so the description's job is to cover behavior — which it does: mutation semantics, byte preservation, redaction limitation, and prerequisite decryption. Nothing an agent needs before calling is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds useful cross-parameter meaning by tying fields to types ('line (needs start/end)', 'link (needs url — http:, https: or mailto:)', 'rect is the clickable area') and restating the 0-based page and [x1,y1,x2,y2] rect conventions. It stops short of explaining quadPoints geometry or colour format trade-offs beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Append markup annotations') and resource ('an existing PDF') plus the exact annotation types supported, which no sibling tool covers. An agent can tell immediately this adds markup rather than editing content, forms, or metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the encrypted-input case: 'Encrypted sources → ENCRYPTED_SOURCE (decrypt_pdf first)', naming the sibling to run first. It also warns that this is a visual overlay only, so it implicitly excludes redaction-style use, but no other exclusions or alternatives are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.