pdfnative-mcp

Merge PDFs

merge_pdfs

Idempotent

Combine 2–50 base64-encoded PDFs into one document, preserving page boxes and links while dropping signatures and forms.

Instructions

Concatenate 2–50 PDFs (pdfsBase64[]) into one fresh, self-contained document. Page-tree rebuild: signatures and AcroForm are dropped, XMP (and thus a PDF/A claim) does not survive — re-declare PDF/A on the generating tools; page boxes and /UserUnit do survive; URI links kept unless dropAnnotations:true. Encrypted sources open with one password (PASSWORD_REQUIRED / PASSWORD_INVALID); output unencrypted unless encrypt. Guards: 256 MiB assembly (maxOutputSizeBytes), 50 MiB output (OUTPUT_TOO_LARGE).

Input Schema

Name	Required	Description	Default
`encrypt`	No	Re-encrypt the output (Standard Security Handler; AES-128 default or AES-256; RC4 never emitted).
`password`	No	Password applied to every encrypted source (pdfnative v1.6.0). Sources with an empty user password open without it. The merged output is unencrypted unless `encrypt` is set.
`outputMode`	No	'base64' (default) returns the PDF inline; 'file' writes it inside the PDFNATIVE_MCP_OUTPUT_DIR sandbox (SECURITY_VIOLATION when the sandbox is not configured).	base64
`outputPath`	No	Required when outputMode='file'. Relative path inside the sandbox; must end with .pdf (no absolute paths, no '..').
`pdfsBase64`	Yes	Base64-encoded source PDFs to concatenate, in order. 2–50 documents. Signatures and AcroForms are dropped (a page-tree edit invalidates them); encrypted PDFs are rejected.
`dropAnnotations`	No	When true, drop ALL annotations. Default (false) keeps self-contained URI link annotations and drops cross-document/widget annotations.
`maxOutputSizeBytes`	No	In-memory assembly guard (pdfnative maxOutputSize): the merge throws before materialising an object graph larger than this. Defaults to 268435456 (256 MiB). Note the emitted PDF is separately capped at 50 MiB by the output layer.

Output Schema

Name	Required	Description
`url`	No	Public URL of the file (file mode, only when PDFNATIVE_MCP_OUTPUT_BASE_URL is set): base URL + sandbox-relative path, percent-encoded.
`mode`	Yes
`summary`	No	Tool-specific summary, when produced.
`filePath`	No	Sandboxed absolute path (file mode).
`sizeBytes`	Yes
`diagnostics`	No	Engine diagnostics (when includeDiagnostics=true).

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.8.0Nov 3, 2026

changedOutput schema / description

Previous value: -"Result of a PDF-producing tool. base64 mode: the PDF arrives as an embedded `resource` content block (not duplicated here); file mode: `filePath`."New value: +"Result of a PDF-producing tool. base64 mode: the PDF arrives as an embedded `resource` content block (not duplicated here); file mode: `filePath` (and `url` when the operator maps the sandbox to a public base URL)."

addedOutput schema / properties / url

Added value: +{
+  "description": "Public URL of the file (file mode, only when PDFNATIVE_MCP_OUTPUT_BASE_URL is set): base URL + sandbox-relative path, percent-encoded.",
+  "type": "string"
+}

Changed1 schema field changedv1.6.2Sep 27, 2026

changedOutput schema / properties / diagnostics / description

Previous value: -"PDF/A diagnostics (when includeDiagnostics=true)."New value: +"Engine diagnostics (when includeDiagnostics=true)."

AddedAug 24, 2026
Removedv1.6.0Jul 22, 2026
Addedv1.2.2Jul 4, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the annotations by disclosing page-tree rebuild consequences (signatures and AcroForm dropped, XMP/PDF-A claim lost, page boxes and /UserUnit preserved, URI links retained), the PASSWORD_REQUIRED/PASSWORD_INVALID codes, and two separate size guards (256 MiB assembly, 50 MiB OUTPUT_TOO_LARGE). This is exactly the lossy-side-effect context an agent needs before committing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and dense with useful facts; nearly every clause carries information. The telegraphic, parenthetical style (fragment sentences, inline error codes) is compact but slightly harder to parse than plain prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, nested-schema merge tool with an output schema already available, the description covers the critical unknowns: lossiness of the page-tree rebuild, encryption/password behavior, output destination safety, and both size limits with error names. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description still adds value by tying `password` to all encrypted sources, clarifying that output stays unencrypted unless `encrypt` is set, and explaining dropAnnotations' selective URI-link retention and the assembly-vs-output cap distinction. Remaining nested permission flags are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: 'Concatenate 2–50 PDFs into one fresh, self-contained document.' The operation is unambiguous and easily distinguished from siblings like split_pdf or extract_pages, and the required input is named inline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear conditional context for how to use it correctly: encrypted sources need the single `password`, output is unencrypted unless `encrypt`, and outputMode selects inline vs sandboxed file. It does not explicitly name alternatives or exclusions (e.g., when to extract/insert pages instead of merging), so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.