Skip to main content
Glama
Sign In
@filesniff/mcp

@filesniff/mcp

by Peth-Dev
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

@filesniff/mcp — Local File Inspection & Provenance MCP Server

@filesniff/mcp is a zero-dependency Node 22+ Model Context Protocol (MCP) server over stdio. It exposes the exact same bounded, local-only ES modules used by File Sniff Online:

  • assets/js/checker/detector.mjs — Magic-byte file identification and ZIP central-directory inspection (sniff_file)

  • static/js/provenance/documents.mjs — Office .docx, .xlsx, and .pptx XML provenance, AI/automation clues, hidden worksheets, fonts, colours, and workflow hints (inspect_office_document)

  • assets/js/image/container.mjs — Lossless container-level EXIF, GPS, XMP, IPTC, thumbnail, and trailer removal for JPEG, PNG, and WebP (strip_image_metadata)

Requirements

  • Node.js 22+ (zero external npm packages required)

Related MCP server: file-analyzer-mcp

Configuration

Option 1: Remote Streamable HTTP MCP (Zero Install, Header-Only)

Connect any Streamable HTTP MCP client directly to https://www.filesniff.dev/mcp (or https://www.filesniff.dev/api/mcp):

{
  "mcpServers": {
    "filesniff-remote": {
      "type": "http",
      "url": "https://www.filesniff.dev/mcp"
    }
  }
}

The remote endpoint enforces a strict 4 KiB request limit (max 512 sample bytes) so full files are never uploaded, and exposes:

  • identify_magic_bytes — Identify a format and extension mismatch from up to 512 leading bytes in hex or base64.

  • lookup_file_format — Look up magic-byte signatures, MIME types, and File Sniff browser tools/guides for any format or extension.

  • explain_provenance_marker — Explain IPTC DigitalSourceType values (trainedAlgorithmicMedia, compositeWithTrainedAlgorithmicMedia, algorithmicallyEnhanced) and C2PA Content Credentials.

Option 2: Local stdio MCP (Full Local Disk Inspection)

For Claude Desktop, Cursor, or Claude Code (mcpServers) when inspecting full local files on disk:

{
  "mcpServers": {
    "filesniff": {
      "command": "node",
      "args": ["/absolute/path/to/FileSniffWebsite/mcp/server.mjs"]
    }
  }
}

Exposed Tools

1. sniff_file

Inspects up to the first 64 KiB (plus any ZIP central directory) of a local file and compares its detected type against its filename extension.

  • Input: { "path": "/path/to/holiday.pdf" }

  • Returns: detectedName, detectedExtension, mime, comparison (match | mismatch | neutral + label such as .pdf → .mp4), note, and first 64 bytes as uppercase hex.

2. inspect_office_document

Inspects a local .docx, .xlsx, or .pptx file without executing macros or fetching external links.

  • Input: { "path": "/path/to/workbook.xlsx" }

  • Returns: format, headline, detail, ai (explicit AI tool references in metadata), automation (openpyxl, python-docx, etc.), metadata, propertyGuide, sheets (including hidden / veryHidden), fonts, colours, authoring, relationships, and hints.

3. strip_image_metadata

Losslessly strips identifying metadata segments from a JPEG, PNG, or WebP file by copying allowlisted pixel and colour chunks verbatim.

  • Input:

    {
  "inputPath": "/path/to/photo.jpg",
  "outputPath": "/path/to/photo-clean.jpg",
  "keepColour": true,
  "keepOrientation": true,
  "keepCredentials": false
}

  • Returns: format, originalBytes, cleanBytes, bytesSaved, orientationBefore, orientationAfter, removedCount, and removed segment list.

Running Tests

node --test tests/mcp.test.mjs

Available Tools

3 tools
inspect_office_documentA

Inspect a local Office document (.docx, .xlsx, .pptx) or PDF (.pdf) for document properties, explicit AI/automation metadata clues (such as ChatGPT, openpyxl, ReportLab or WeasyPrint), hidden Excel worksheets, fonts, colours, and package workflow hints.

NameRequiredDescriptionDefault
pathYesPath to the local .docx, .xlsx, .pptx, or .pdf file.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden: 'Inspect' implies a non-mutating read, and the enumerated facets give a good sense of what the tool looks for. It does not disclose error behavior on unsupported/corrupt files, file-size or permission constraints, or how findings are presented, so meaningful behavioral gaps remain for an annotation-free tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the verb and target scope first, followed by the inspection facets. Minor waste in the trailing 'package workflow hints', which is vague and partially overlaps with the earlier 'AI/automation metadata clues'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only inspection tool with no output schema, the enumerated list of inspected facets effectively stands in for a description of return content, which is the main thing an agent needs. It falls short only on how results are formatted and what happens with unsupported or malformed files.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With one parameter and 100% schema description coverage, the schema already documents 'path' fully. The description reinforces the accepted extensions (.docx/.xlsx/.pptx/.pdf), adding a small amount of constraint meaning (local paths only), but introduces no syntax, directory, or edge-case detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Inspect') plus an enumerated resource set (.docx, .xlsx, .pptx, .pdf) and details the exact forensic facets it extracts (document properties, AI/automation tool fingerprints, hidden sheets, fonts, colours). It is clearly a metadata-forensics tool rather than a general file reader, though it never names or distinguishes itself from the sibling 'sniff_file', so differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the combination of 'local' file scope and the Office/PDF format restriction, which tells an agent this is not for remote URLs or arbitrary binaries. However, there is no explicit statement of when to choose this over 'sniff_file' (which presumably also inspects files) or when not to use it, leaving the routing decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sniff_fileA

Identify a local file from its binary magic bytes and container structure without trusting its filename extension. Detects mismatches (e.g. an MP4 disguised as a PDF or a Word document saved as .zip).

NameRequiredDescriptionDefault
pathYesPath to the local file to inspect.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full disclosure burden. It usefully discloses the detection mechanism (magic bytes plus container structure) and the key premise that the extension is untrusted, which implies a side-effect-free read of local content. It does not say what is returned (detected type, mismatch flag, both), how unreadable or nonexistent paths are handled, or whether the whole file or only headers are read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the mechanism and the trust model come first, and two parenthetical examples make the value concrete. No filler, no repetition of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, with one required parameter and no annotations. But there is no output schema, so the description is the only place an agent can learn what 'identify' returns, and it does not say. That gap matters for an agent that has to decide what to do with the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage ('Path to the local file to inspect'), so the schema already carries the meaning. The description adds the relevant constraint that content rather than the extension is authoritative, but nothing else about the path parameter needs explaining.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: 'Identify a local file from its binary magic bytes and container structure.' It also scopes the tool with 'without trusting its filename extension' and gives concrete examples of the mismatches it detects. It never names the sibling tools inspect_office_document or strip_image_metadata, so an agent must infer the boundary with those from their names alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case comes only from implication: verify true file type, catch a disguise. It does not state when to use this tool instead of inspect_office_document for Office files, or whether it is meant as a pre-check before other inspection tools. No prerequisites or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

strip_image_metadataA

Losslessly strip identifying metadata (EXIF, GPS, XMP, IPTC, comments, thumbnails, trailers) from a JPEG, PNG, or WebP file without re-encoding pixel data.

NameRequiredDescriptionDefault
inputPathYesPath to the source JPEG, PNG, or WebP image.
keepColourNoKeep ICC colour profiles and colour chunks (default: true).
outputPathYesPath where the cleaned image will be written.
keepCredentialsNoKeep C2PA Content Credentials / JUMBF segments (default: false).
keepOrientationNoKeep minimal EXIF orientation tag when rotated (default: true).

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it does disclose the key trait that stripping is lossless with no pixel re-encoding. However, it is silent on write semantics: whether outputPath is created or overwritten, what happens if it already exists, whether the operation is reversible, and that C2PA credentials are stripped by default. Those gaps matter for an irreversible mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence that front-loads the action and the guarantees, with the enumerated metadata list and the no-re-encode assurance doing real work. There is no filler and nothing to trim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter file-mutation tool with no annotations and no output schema, the description covers what is removed and how, but omits return/confirmation behavior and destructive-write semantics. Because keepCredentials defaults to false, the fact that Content Credentials are deleted unless opted in is a side effect an agent should be told about here rather than discover from the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters are already documented with defaults, and the description adds essentially nothing beyond that baseline. It reinforces the accepted formats for inputPath but adds no meaning about the three keep* flags or their interaction with the stripped segment list.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb (strip) and resource (identifying metadata), then enumerates the exact metadata classes removed (EXIF, GPS, XMP, IPTC, comments, thumbnails, trailers) and the accepted file formats. The stated input formats also separate it cleanly from the sibling inspect_office_document, so an agent can route without reading either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage is implied rather than stated: the tool removes privacy-sensitive metadata, so an agent can infer this is for sanitising images before sharing. There is no explicit when-to-use or when-not-to-use guidance, no prerequisites (e.g., write permissions or whether outputPath may equal inputPath), and no mention of alternatives or a validation-first path via sniff_file.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv1.0.0
    • First observedinspect_office_document
    • First observedsniff_file
    • First observedstrip_image_metadata
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: sniff_file identifies file types, inspect_office_document inspects document metadata, and strip_image_metadata removes image metadata. The boundaries are clear despite sniff_file being broad, because it does not overlap with metadata inspection or stripping.

Naming Consistency5/5

All three tools follow a consistent snake_case verb_noun pattern: sniff_file, inspect_office_document, strip_image_metadata. The naming is predictable and readable.

Tool Count5/5

Three tools are well-scoped for a focused file-inspection and metadata-privacy server. Each tool earns its place without redundancy or excessive surface area.

Completeness3/5

The set covers file-type identification, Office/PDF inspection, and image metadata stripping, but has notable gaps: no generic image metadata inspection before stripping, no metadata stripping for PDF/Office documents, and no batch or directory-level operations. These gaps limit end-to-end workflows for the apparent domain.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Related MCP Connectors

Related MCP Servers

  • EXIF MCP Server

    nextframedev
    A
    license
    A
    quality
    D
    maintenance
    Inspect and remove EXIF metadata locally through MCP tools. Supports reading EXIF, detecting GPS, summarizing privacy risks, and stripping EXIF from images.
    11
    3
    MIT

  • file-analyzer-mcp

    saewookkangboy
    F
    license
    Not graded
    quality
    C
    maintenance
    Enables local, read-only extraction of text and structure from PDF, DOCX, PPTX, SVG, and PNG files, including OCR for images, directory tree and metadata reporting, with strict path isolation and audit logging.
    -

  • doc-redactor

    agxhub
    A
    license
    A
    quality
    C
    maintenance
    Provides a local-first MCP server for multi-format document redaction, enabling detection of sensitive content, physical removal from PDFs, DOCX, XLSX, PPTX, and text files, and forensic audit with zero network calls.
    7
    AGPL 3.0

  • MCP_Documents

    azzindani
    F
    license
    B
    quality
    A
    maintenance
    Enables local, offline document extraction and manipulation—PDF first but also HTML, DOCX, XLSX, PPTX, EML, EPUB, Markdown, and plain text—through tools for probing, locating, extracting, converting, assembling, OCR, protecting, and redacting documents, with nothing leaving the machine.
    7
    -