Paperboy
OfficialPaperboy is an MCP PDF server for inspecting, securing, editing, converting, and assembling PDFs.
Inspect PDFs: page count, file size, version, encryption status, metadata, structural problems, and extract text.
Read and write document metadata such as title, author, subject, keywords, creator, and producer.
Encrypt PDFs with AES-256, AES-128, or RC4, including print/copy/modify restrictions; decrypt PDFs when the password is known.
Rearrange, duplicate, reverse, delete, extract, and rotate pages.
Merge multiple PDFs, split one PDF into ranges or single pages, and combine images into one PDF.
Optimize PDFs by linearizing and recompressing, repair damaged PDFs, and flatten forms/annotations when qpdf is available.
Convert images, text/Markdown, Office documents, and HTML into PDFs, with LibreOffice required for Office/HTML conversion.
Enables the convert_to_pdf tool to turn Office documents (docx, xlsx, pptx, odt) and HTML files into PDFs using a locally installed LibreOffice (soffice) binary, extending the server's conversion capabilities beyond images and plain text.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PaperboyMerge report-1.pdf and report-2.pdf into one file."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
๐ฐ Paperboy
A production-ready Model Context Protocol server for PDF tools.
Encrypt, decrypt, merge, split, reorder, rotate, optimize, repair, convert, and inspect PDFs โ straight from your AI assistant.
Built by Sudo Stash ยท MIT licensed ยท pip install paperboy-mcp
Connect it to Claude Desktop, Claude Code, Cursor, or any MCP client and ask in plain language: "Password-protect this contract with AES-256," "merge these three PDFs and drop the blank pages," "turn this folder of scans into one PDF," "this file won't open โ can you repair it?"
The engine is built on pikepdf (which wraps qpdf), so it handles real-world, damaged, and encrypted PDFs that pure-Python tools choke on.
Quickstart
Working in Claude Desktop in under a minute:
pip install paperboy-mcp # 1. install
paperboy install claude-desktop --root ~/Documents # 2. wire it into Claude, scoped to one folder3. Fully quit and reopen Claude Desktop (Cmd/Ctrl+Q โ a window reload isn't enough) so it loads the new server.
4. Put a PDF in ~/Documents and just ask:
"Encrypt ~/Documents/contract.pdf with the password hunter2 and save it as contract-locked.pdf" "Merge report-1.pdf and report-2.pdf into one file." "Rotate page 1 of scan.pdf 90ยฐ and drop the last page." "This file won't open โ can you repair it?"
Output files are written back into your --root folder. Remove the server anytime with
paperboy uninstall claude-desktop. Using Cursor, Windsurf, or Claude Code instead? See
Connect it to your AI.
Want to sanity-check without an AI? With the package installed, drive the engine directly:
from pathlib import Path from paperboy.config import Settings from paperboy import engine as E s = Settings(root=Path.home() / "Documents") print(E.pdf_info(Path.home() / "Documents" / "test.pdf", s)) E.encrypt_pdf(Path.home()/"Documents"/"test.pdf", Path.home()/"Documents"/"test-locked.pdf", "secret", s)
Related MCP server: 1pdf
Tools
Tool | What it does |
| Page count, size, version, encryption status, metadata |
| Read / write title, author, subject, keywords, creator, producer |
| Pull text from all or selected pages |
| Find a word or phrase (literal, optional case and whole-word matching): each match's page, a snippet around it, and its rectangles on the page; lists pages with no text layer (read-only) |
| Find tables (ruled, or laid out by alignment) and return their rows (read-only) |
| Save each table as a CSV file for Excel, with formula-like cells escaped so a spreadsheet won't run them |
| List the review comments (sticky notes, highlights, text boxes, stamps, ...): author, text, dates, replies, and the text under each highlight (read-only) |
| Add highlights, underlines, strikeouts and squiggles (over text it finds, or rectangles), sticky notes, text boxes and replies, drawn so they look the same in every viewer |
| Read the text as Markdown for a model: headings (from font sizes), lists, paragraphs and tables, in reading order (following columns); the PDF's text is escaped so it can't add links or HTML (read-only) |
| Save that Markdown as a |
| Compare two versions page by page: pages matched first (insertions don't shift everything), then the lines removed and added, and optionally how pages look (% of pixels changed, with red/green difference images) (read-only) |
| Run several one-file tools in one call (e.g. decrypt โ delete pages โ optimize โ encrypt), each on the result of the last; only the final file is saved, and nothing if a step fails |
| List the PDFs under |
| Validate structural integrity and report problems |
| Add a password โ AES-256 (default), AES-128, RC4 โ with print/copy/modify restrictions |
| Remove a password you know (not a cracker) |
| Reorder, reverse, or duplicate pages |
| Remove or pull out pages |
| Rotate all or selected pages 90/180/270ยฐ |
| Crop pages by margins (top, right, bottom, left as seen; pt, in or mm), or reset the crop. Hides, doesn't remove, content |
| Change pages to A3/A4/A5/Letter/Legal/Tabloid or a custom size, scaling content to fit; links, fields and comments move with it |
| 2 pages per landscape sheet or 4 per portrait sheet, in reading order, for handouts and printing; places page content only (flatten first to keep comments and filled-in fields) |
| Insert blank pages after given page numbers (0 = before the first), sized like their neighbour |
| Combine fronts and backs from a single-sided scanner into one PDF (backs reversed by default) |
| Combine PDFs in order (per-file passwords supported) |
| Split into ranges or one file per page |
| Linearize ("fast web view") and recompress to shrink; optionally lower picture resolution to a DPI ( |
| Rebuild a damaged file's structure |
| Flatten form fields and annotations (needs qpdf CLI) |
| Image / text / Office / HTML โ PDF (Office needs LibreOffice) |
| Combine images into one PDF |
| Show up to 5 pages to the assistant as images, so it can see layouts, scans, charts, and signatures (read-only) |
| Find blank pages (no text, no ink) to pass to |
| List a form's fields: full name, type, value, allowed options, required/read-only (read-only) |
| Fill in form fields by name (text, checkboxes, radio buttons, drop-downs); every value is checked first, appearances are regenerated, optional flatten. Signed PDFs are refused |
| List the bookmarks (outline) in reading order: level, title, target page, and any link or other action (read-only) |
| Replace the bookmarks from a list of title, page and level (nesting); an empty list removes them. Refuses signed PDFs |
| List embedded files (document or page attachments): name, description, declared and detected type, and whether it can run on a computer (read-only) |
| Save embedded files to a folder under safe names; programs and scripts are skipped unless |
| Save the pictures drawn on pages (and in their forms) as image files, usually photos as the original JPEG, once each, optionally by page and minimum size; inline, annotation, pattern and Type 3 images are not extracted |
| Report what a PDF carries besides its pages: metadata (author, software), scripts and risky actions, attachments, comments, application data, earlier saved versions (read-only) |
| Risk report for a PDF you didn't make: scripts (especially ones that run on open), actions that run without a click, program-launching actions, attachments that are programs or disguise their type (attached PDFs are scanned too), disguised names, data hidden around the file, and known malware if ClamAV is installed. Verdict: no active content found / active content / suspicious, never "safe" (read-only) |
| Write a copy safe to share without that hidden data (comments optional); links, bookmarks and accessibility structure are kept |
| Redact for real: text (words, phrases or regular expressions such as email addresses) and areas of pages (a signature, a photo) are removed from the file, not just covered. Characters are taken out of the page, pictures have their pixels blanked, drawings and annotations there go, and the same text is replaced in metadata, bookmarks, comments and form values. Every page is checked afterwards; one that can't be redacted exactly becomes a picture of itself |
| Make scans searchable: Tesseract OCR reads each page and an invisible text layer is placed over the words, so they can be searched, selected and copied; the pages look exactly as before. Pages that already have text are skipped; any installed language (needs Tesseract) |
| PDF/A-2b copy for long-term archiving (courts, governments, archives): adds the sRGB colour profile and PDF/A metadata, removes what PDF/A forbids (scripts, attachments, encryption, hidden annotations), never redraws pages. Checked by veraPDF when installed and written only if it passes; refuses with reasons what it can't fix (fonts not embedded, CMYK colour) |
| Text ("CONFIDENTIAL", "DRAFT") or image watermark, or a corner stamp ("APPROVED"): position, size, colour, opacity, rotation, over or under the content |
| Page numbers ("Page {n} of {total}") or Bates numbers ("ACME-{n:06}"), any corner or edge, with a start number and page selection |
| Save pages as PNG or JPEG files at 36-600 dpi (copy-protected PDFs need the owner password) |
Typed results. Every tool publishes an MCP outputSchema and returns structuredContent,
so assistants read exact fields (pages, password_protected, files...) instead of parsing
text. Every field is always present; a value that doesn't apply is null (for example,
pdf_info on an encrypted file without its password returns "pages": null and a note).
Page specs are 1-based and accept ranges, last/end, open ranges (4-), and reversal (5-1):
e.g. "1,3,5-8", "last,1-4", "5-1". Existing files are never overwritten unless overwrite=true.
Resources and prompts
paperboy://pdfsโ a resource listing the PDFs underPAPERBOY_ROOT(aslist_pdfs), for clients that let you attach resources.Prompts your client may offer as shortcuts:
prepare_for_signing,compress_for_email(with a size in MB),share_safelyandcheck_untrusted_pdf. Each takes a file path and guides the assistant through the right tools in order.
Install
Requires Python 3.10+. The quickest path is uv:
uvx --from paperboy-mcp paperboy # run without installing
# or
pip install paperboy-mcpFrom source:
git clone https://github.com/sudostash/paperboy
cd paperboy
pip install -e ".[dev]"Optional system binaries
Binary | Enables | Install |
LibreOffice ( |
|
|
qpdf CLI |
|
|
Tesseract ( |
|
|
veraPDF ( | checks |
|
ClamAV ( | known-malware signatures in |
|
Everything else (encryption, merge, split, optimize, repair, image/text conversion) works with no system binaries โ pikepdf ships qpdf in its wheel.
Connect it to your AI
One command (recommended)
The CLI writes the config into your client for you โ no hand-editing JSON:
paperboy install claude-desktop --root ~/Documents
paperboy install cursor --root ~/Documents
paperboy install claude-code --root ~/Documents # uses `claude mcp add`
paperboy install all --root ~/Documents # every detected clientSupported clients: claude-desktop, claude-code, cursor, windsurf.
Add --uvx to have the client launch the server via uvx (no global install needed).
--root sets the sandbox directory (see Security). Undo with paperboy uninstall <client>.
paperboy list-clients # show which clients are detected and where their config lives
paperboy config --root ~/Documents # print a snippet to paste into any other MCP clientIf you haven't installed the package globally, run the installer through uv:
uvx --from paperboy-mcp paperboy install claude-desktop --root ~/Documents --uvxManual config
Any MCP client takes the same shape โ paste this into its config
(for Claude Desktop, claude_desktop_config.json):
{
"mcpServers": {
"paperboy": {
"command": "uvx",
"args": ["--from", "paperboy-mcp", "paperboy"],
"env": { "PAPERBOY_ROOT": "/Users/you/Documents" }
}
}
}If you installed with pip, use "command": "paperboy" and drop the --from args.
paperboy config prints this for you with your own paths filled in.
Configuration
All configuration is environment variables. Sensible defaults; nothing is required.
Variable | Default | Purpose |
| (unset) | Strongly recommended. Confine all reads/writes to this directory tree. |
|
| Reject inputs larger than this. |
|
| Reject documents with more pages than this. |
|
| Seconds before a LibreOffice conversion is killed. |
|
| Default for the |
|
| Refuse passwords given in tool arguments; only |
| (auto) | Path to the |
| (auto) | Path to the |
| (auto) | Path to ClamAV's |
|
| Seconds before a ClamAV scan is stopped. |
| (auto) | Path to the |
| (auto) | Path to the |
|
| Logging verbosity (logs go to stderr). |
Security
Set
PAPERBOY_ROOT. Without it the server can read and write anywhere the OS user can; with it, every path is resolved (symlinks and..included) and rejected if it escapes the tree.File-size and page-count caps keep a malicious or runaway PDF from exhausting memory.
Subprocess timeouts bound every LibreOffice, qpdf, Tesseract and veraPDF call.
No silent overwrites โ a tool refuses to clobber an existing file unless you opt in.
Protected stays protected. Rotating, reordering, splitting, merging, optimizing, repairing, flattening, or editing the metadata of a password-protected PDF produces a protected output: AES-256, the same user password, and the same permissions. Only
decrypt_pdfremoves a password. Results say"password_protected": true(or"permissions_restricted": truefor files that open freely but restrict printing/copying).Supplying the user password: the output gets a new random owner password, so its restrictions stay enforced.
Supplying the owner password: older encryption (RC4, AES-128) lets qpdf recover the user password, so it is kept. For AES-256 it can't be recovered, so the output opens with the password you supplied and the result says
"user_password_changed": true.Merging protected files: they must share one password (otherwise the merge is refused, so no input's pages become readable with another input's password), and the output gets the strictest permissions of all its inputs.
Permissions are enforced. A protected PDF has a user ("open") password and an owner password that lifts its restrictions. Opened with the open password (or none), a PDF keeps its restrictions:
Copying: getting its content out (
extract_text,search_text,compare_pdfstext,render_pages,extract_attachments,extract_images,extract_tables,export_tables,pdf_to_markdown,export_markdown) needs the owner password when the PDF forbids copying.view_pagesandcompare_pdfsin visual mode (display) work with the open password.Document assembly (adding, removing, reordering or rotating pages): the page tools (
rearrange_pages,delete_pages,extract_pages,rotate_pages,split_pdf,insert_blank_pages,n_up, and each input ofmerge_pdfsandinterleave_pdfs).Changing the document:
crop_pages,resize_pages,n_up,set_metadata,flatten_pdf, stamps, redaction, sanitizing, OCR, andoptimize_pdfwhen it lowers picture resolution.Changing annotations (comments, links, form fields):
add_comments,flatten_pdf,fill_formwithflatten, andresize_pages,sanitize_pdfandredact_pdfwhen they would move, change or remove annotations. (list_commentsgives the text under highlights only when copying is allowed.)Any restriction at all:
decrypt_pdf, re-encrypting withencrypt_pdf, andconvert_to_pdfa(which can't be encrypted) would lift every restriction, so they need the owner password unless the PDF restricts nothing.
Digitally signed PDFs are refused by every tool that would rewrite the signed document (and so invalidate its signature); Reader usage rights are dropped, since they break once the file changes. A new document made from a signed PDF's pages (extract, split, merge, ...) is not signed: copied signature fields lose their value and their signed appearance. Outputs that keep the input's protection (rotate, merge, split, ...) keep its restrictions too.
Non-ASCII passwords work with every encryption scheme. RC4/AES-128 files store passwords in PDFDocEncoding and AES-256 in UTF-8; every tool opens files the same way (through pikepdf) and tries the right encoding, so
cafรฉorpโฌsswork everywhere.Rendering is bounded. Each image is capped at 40 megapixels and each
render_pagescall at 400 megapixels in total. PDFium calls are serialized (it is not thread-safe), and files are written via a temporary file and an atomic rename, never through a link.Listing shows what's in the root.
list_pdfsandpaperboy://pdfslet the assistant see the name, size and date of every PDF underPAPERBOY_ROOT(not hidden ones) without you naming a file; it never reads their contents, follows links out of the root, or walks more than 50,000 entries. File names are passed on as data; ones with control characters are left out.Pipelines run each step under its tool's own rules.
run_pipelinechecks every step's arguments before running any, applies the file-size cap to each intermediate file, and keeps the input's protection (and owner password) through the chain. Steps hand files over in a private temporary folder in the system's temp directory, which can briefly hold a decrypted copy after adecrypt_pdfstep; each is removed once used.Extraction is bounded and careful with names.
extract_attachmentsandextract_imagesdecode with byte budgets and refuse data they can't measure (decompression bombs, predictor or JPEG headers that disagree with the image's size); each call has a total limit (4x the file-size cap, and 400 megapixels of images). Attachment names become safe file names (no folders, reserved or invisible characters); programs and scripts are skipped unless asked for; outputs never replace links, folders or the input; and a failed run removes what it wrote. Extracted files are not password-protected, even when the PDF is.Lowering picture resolution is conservative.
optimize_pdfworks out each picture's resolution from the largest size the pages draw it at (through forms, and/UserUnit), and leaves alone any picture it can't account for: one a page or form it couldn't read may draw, or one an annotation appearance, pattern or Type 3 glyph may draw. Only 8-bit grey and RGB pictures (Flate or JPEG, with or without a soft mask) are re-encoded; palettes, CMYK, masks, JPEG 2000 and very progressive JPEGs stay as they are, a shared soft mask is copied rather than changed, and a picture is replaced only when that makes it smaller. Pictures pass the same checks asextract_imagesbefore being decoded. Content is measured before it is parsed (16 MB and 500,000 tokens per page or form, 64 MB and 1.5 million tokens per call), the resources followed are counted, and a call stops trying smaller steps after 3 minutes, keeping the best result so far. Attempts are saved in a private folder beside the output, which is replaced only at the end, keeping its permissions. Text and vector drawings are never touched, but in scans the text is itself a picture and can blur at the lowest steps (72 dpi).Redaction removes, then checks.
redact_pdfrewrites each page's content without what lies under the areas. A character whose centre is in an area is taken out of its string (the space it took is kept, so the rest of the line doesn't move); pictures partly covered have those pixels set to zero in a copy (masks too); pictures, forms and drawings wholly inside are dropped. Drawings crossing an area are cut exactly where they can be: a filled rectangle (a background, a barcode bar) becomes the rectangles around the area, and straight lines are cut at its edges (by half the line's width more, so their ends don't reach back in). Anything else crossing an area (a signature, lettering drawn as shapes or used as a clipping path, a dashed line, a pattern, a shading that can hold a picture) can't be cut exactly. Annotations touching an area are removed (a form field entirely, value included), as are the page's thumbnail, editor data and page metadata, XMP page thumbnails, and replacement or alt text (/ActualText,/Alt) describing what was removed. Texts and patterns are found in page text and in what annotations show (every appearance state, up to 10,000), and are also replaced in metadata (XMP is dropped if it matches), bookmarks, comments, form values, structure, scripts, rich text and XFA data; attachments can't be searched, so the result counts them (sanitize_pdfremoves them). Shared pictures and forms are copied, so other pages keep theirs; then every original redaction replaced or removed is cut from the file wherever else it's referenced (shared or inherited resources, thumbnails, alternates, structure tree, actions,/CO), unless content that can be read still draws it (another page or form, or an annotation's appearance): those are counted inoriginals_kept, since that content shows them unredacted; look there. Pictures, forms and property lists a redacted page lists but never draws are removed from its resources. Renamed named destinations and other name-tree keys are rebuilt into one sorted list, so links still work. PDFium then reads every rewritten page again: nothing may remain under an area, and nothing outside it may change or move; the texts and patterns are searched for again too. A page that fails those checks, or can't be followed exactly (fonts without widths, vertical writing, CMaps it can't read, text used as a clipping path, a character mostly under an area, Type 3 glyphs reaching under one, JPEG 2000, JBIG2, CCITT or CMYK JPEG pictures, anActualTextonly partly covered, too much content), is replaced by a picture of itself with the areas painted over;rasterize="never"refuses instead. Limits: text PDFium can't read (zero-width or overlapping duplicate glyphs) isn't found by texts or patterns, so check the result; a removed word leaves a gap of its width; text in pictures (scans) isn't text, so such pages are listed inpages_without_textand need areas, orocr_pdffirst (then only what OCR read correctly is found, so check);matcheslists the text matched. Patterns run in a separate process with a CPU limit and a 30-second deadline, so a pattern that backtracks badly can't hang the server (memory is limited only on Linux); content is measured before it is parsed (16 MB and 1 million tokens per page or form, 64 MB per call; fonts 64 MB), and a call stops after 3 minutes, writing nothing. Signed PDFs are refused; Reader usage rights are dropped.OCR adds text and changes nothing else.
ocr_pdfchecks and renders each page as displayed (rotation and crop box applied) with PDFium in a separate process, from a decrypted copy handed over in memory, with a CPU limit; it is killed at the call's deadline, so a page that would take PDFium hours can't hang the server or block other tools. Only the rendered picture goes to Tesseract, in a private temporary folder deleted afterwards. Tesseract's text-only page is placed over the page as invisible text (render mode 3), mapped back through the page's rotation and crop box (a page whose boxes or rotation PDFium reads differently is refused rather than misplaced), and isolated from the page's own graphics state; content is measured before it is parsed for that (16 MB and 500,000 tokens per page). The page's content and pictures are kept (JPEG scans byte for byte), one copy of Tesseract's font is shared by every page, and protection and permissions are kept as for the other tools; a PDF that forbids copying needs its owner password, since the text layer makes its words copyable. Language codes are checked against the languages Tesseract reports as installed, Tesseract gets settings rather than config-file names (which it would also look for in the current directory), and nothing else reaches its command line. Pages are rendered at most 25 megapixels (fewer dpi for very large pages); at most 4 Tesseract processes run at once across all calls (waiting for one counts toward the call's time); each run is stopped after 2 minutes (with anything it started), and the whole call after 10 minutes, writing nothing. Signed PDFs are refused; Reader usage rights are dropped. OCR is never perfect:mean_confidenceper page says how sure Tesseract was, and text printed sideways isn't read.PDF/A is checked, not assumed.
convert_to_pdfanever redraws a page. It follows the veraPDF rules for ISO 19005-2 level B:adds an sRGB output intent (made by LittleCMS through Pillow) unless the file has a valid RGB or CMYK one, and fresh XMP metadata with the PDF/A identification, built from the document info and eleven standard properties of the old XMP (title, authors, description, subject, rights, language, keywords, producer, creator tool, and valid creation and modification dates); others would need extension schemas;
removes actions PDF/A doesn't allow (anything but go-to, link, thread, submit and page-turning named actions; also inside link chains and form fields), event actions, attached and associated files, encryption, annotations PDF/A doesn't allow or that are hidden or have nothing to show (a hidden form widget alone; its field too once no widget is left), rollover appearances, XFA, transfer functions and other printer settings, picture alternates and smoothing, PostScript, and metadata on pages and pictures; LZW data is re-compressed with Flate (measured first: up to 8 MB of LZW decoding to 64 MB); text over 32,767 bytes is shortened;
fixes print flags, button appearances, layer configuration names and order, and draws form fields (with the resources they use) when the file asks the viewer to;
refuses what it can't fix without changing how pages look: fonts drawn visibly without being embedded, CMYK colour with an RGB profile (or RGB with a CMYK one), PostScript drawings, data in other files, page boxes outside 3โ14,400 units.
It reads page content (and the forms, patterns, soft masks, appearances and glyphs it draws) to see what is actually drawn, measuring every stream before parsing it (a stream listed many times is decoded once and counted each time) within one budget per call (16 MB and 1 million tokens per stream, 128 MB and 4 million tokens in all, a million forms entered); every walk over the file counts the dictionaries and arrays it visits (a million; long arrays count per thousand items) and stops at 2 minutes; at most 16 output intents are looked at, colour profiles, XMP and drawn fields are measured before they are read, and the copy is saved without decoding streams, so data that would inflate to gigabytes isn't inflated (streams nothing uses are copied as they are). With veraPDF installed, the result is checked against the PDF/A-2b profile in a private temporary folder (veraPDF gets a minimal environment and 1 GB of memory, is killed after 5 minutes with its JVM, and its report is cut off past 32 MB) and written only if it passes; its verdict wins over the checks above. Without veraPDF the copy is written with
validated: false: it carries the PDF/A identification but may not conform, since some rules (such as glyph widths matching the font program) need veraPDF. The copy has no password, so a protected PDF that forbids copying needs its owner password; signed PDFs are refused; Reader usage rights are dropped. Messages name fonts from the file only in printable characters, cut short.Tool annotations tell clients what each tool does. The four inspection tools (
pdf_info,get_metadata,check_pdf,extract_text) are markedreadOnlyHint, so clients may run them without a prompt. Every tool that writes a file is markeddestructiveHint(overwrite=truecan replace an existing file), so clients keep asking first. No tool touches the network (openWorldHint: false). Hints are advisory; the server-side checks above are what enforce safety.Passwords can stay out of the conversation. Pass
"ask"as any password argument and Paperboy opens a one-time page on127.0.0.1where you type the password; it goes straight to the server, never into the model's context, the client, or the tool-call log. Clients with URL-mode elicitation offer to open the page and the call carries on once you've typed it (the MCP spec forbids asking for passwords in a client form). With other clients the tool replies with the link; open it, type the password, and run the tool again with the"ask:<ref>"value from the reply. Each link has an unguessable token, works once, and expires after 10 minutes; the page answers only on127.0.0.1with the exactHost(no DNS rebinding) and is never logged. New passwords (encrypt_pdf, an encrypt step inrun_pipeline) are typed twice. The file is checked before you're asked, a call asks at most 5 passwords, and file names on the page are shortened and stripped of control characters. A typed password works only for the tool, argument and file it was asked for, so an"ask:<ref>"can't be spent elsewhere; with a typed user password,encrypt_pdfunder the older algorithms (AES-128, RC4) refuses an owner password given in the arguments, since those schemes let the owner password reveal the user password. Cancelling or declining forgets the link. When the tool replies with a link, the model sees that link too, so open only links on127.0.0.1and check the page names the file you expect."ask"and"ask:..."are reserved, not passwords. Passwords given directly as arguments still work, and do appear in the log;PAPERBOY_REQUIRE_PASSWORD_REFERENCES=truerefuses them.decrypt_pdfrequires the real password; it does not crack anything. Passwords handed to the qpdf CLI go over stdin, never the command line, so other local users can't read them from the process list, andcheck_pdfredacts the password qpdf echoes back.Internal errors stay on the server. Anticipated problems (bad path, wrong password, out-of-range page) are returned with a clear message; anything unexpected is logged by the server and the client only sees a generic "internal error", on both mcp 1.x and 2.x.
Copy protection never blocks screen readers.
allow_copy=falsestops text extraction but always keeps the accessibility permission, as PDF 2.0 requires (RC4-40, the oldest scheme, has no separate accessibility bit).
Architecture
paperboy/
โโโ engine/ โ transport-agnostic library: pure functions, paths in, dict out
โโโ server.py โ thin MCP adapter: path confinement, limits, error mapping
โโโ config.py โ Settings from environment
โโโ paths.py โ root confinement + size caps
โโโ pagespec.py โ "1,3,5-8,last" parsing
โโโ errors.py โ PdfUserError (shown to caller) vs internal crashesThe engine has no dependency on MCP. The server is a thin layer that enforces policy and presents errors. That separation is deliberate: the same engine can back a remote streamable-HTTP transport (with upload/download + auth) without touching the PDF logic.
Development
pip install -e ".[dev]"
pytest # engine, path confinement, server policy, CLI, installer, real stdio round-trip
pytest --cov=paperboy --cov-branch --cov-report=term-missing # CI requires >= 95% branch coverage
ruff check .Every module has a test file (tests/test_<module>.py). Tests that need the qpdf CLI skip when
it is absent; LibreOffice conversions and OCR are tested with stand-in soffice and
tesseract scripts, so they run everywhere (OCR tests also run the real Tesseract when it is
installed); PDF/A tests use a stand-in verapdf, and also the real one when installed. CI also runs the suite against mcp 1.x.
Before opening a pull request, run the CI jobs locally (GitHub Actions is currently turned off for this repository):
scripts/ci-local.sh # lint, Python 3.10-3.13 with the coverage gate, mcp 1.x,
# lowest dependency versions, and the browser demos
scripts/ci-local.sh lint test-3.12 # just some jobsIt needs uv (which fetches any missing Python version) and
qpdf, and keeps one virtualenv per job in .ci/.
Demo videos
demos/ records a short tutorial video for each feature. Every scenario runs against the real
server over stdio, then a Playwright-driven viewer replays it (chat on the left, before/after
PDF pages on the right). See demos/README.md.
pip install -e ".[demo]" && playwright install chromium
python demos/record.py # writes demos/out/videos/<scenario>.webmRoadmap
Streamable-HTTP transport with OAuth + per-session file isolation (hosted mode)
License
MIT โ see LICENSE. Third-party component licenses are listed in NOTICE.md.
Available Tools
18 toolscheck_pdfC
Validate structural integrity and report any problems found.
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | ||
| input_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. 'Validate... and report' implies a non-destructive read, but it never states that the PDF is not modified, how encrypted files are handled, whether it fails or returns a problem list on invalid input, or what the report contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It is efficient, though the terseness is achieved partly by omitting information the tool actually needs to convey.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and undocumented parameters mean the description must do more than one sentence. It omits what 'problems' are reported, how the result is returned, password handling, and the relationship to repair_pdf.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Two parameters with 0% schema description coverage, and the description adds no meaning for either. In particular, the password parameter's role for encrypted PDFs is left completely unexplained, so the description does not compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (validate) and the target (structural integrity) with a reporting outcome, which is more informative than the bare name check_pdf. However, it never says the resource is a PDF file and never distinguishes itself from the adjacent sibling repair_pdf, so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of the obvious alternative repair_pdf. The check-then-repair workflow is exactly the decision an agent faces here, and the description leaves it entirely unaddressed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
convert_to_pdfB
Create a PDF from an image, a text/markdown file, or an Office/HTML document.
Office/HTML (docx, xlsx, pptx, odt, html, ...) requires LibreOffice installed.
| Name | Required | Description | Default |
|---|---|---|---|
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose a genuine behavioral trait beyond the schema: Office/HTML inputs require LibreOffice, which warns the agent about a possible failure mode. It says nothing, however, about whether existing files are overwritten, what the default output_path is, or what the return value/errors look like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, purpose front-loaded, dependency stated as a follow-up constraint. Every sentence earns its place and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and 0% schema coverage, the description should carry more. It covers the conversion capability and one dependency, but omits overwrite semantics, output_path defaulting, and return/failure behavior, leaving an agent to guess on two of three parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 3 parameters, so the description must compensate. It partially covers input_path by naming the accepted input formats, but leaves output_path and overwrite entirely undefined, including the meaning of the null defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Create) and resource (PDF) and enumerates the accepted input kinds: image, text/markdown, Office/HTML document. That is clear enough to know what the tool produces. It does not, however, differentiate itself from the sibling images_to_pdf, which overlaps on the image case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives, and the obvious overlap with images_to_pdf is never addressed, so an agent cannot tell which to pick for an image input. The only conditional content is a runtime dependency (LibreOffice), which is a prerequisite rather than usage routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decrypt_pdfB
Remove the password from a PDF, given its correct password. Not a cracker.
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that a correct password is required and that this is not a brute-force cracker, which materially shapes expectations of failure. However, it says nothing about whether the file is rewritten in place, how 'overwrite' behaves, or what happens on a wrong password.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no filler, with the operation stated before the disqualifying caveat. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations, no output schema, and 4 undocumented parameters mean the description is the only source of behavior, yet it omits output destination and overwrite semantics โ the details most likely to cause a wrong or destructive call. Inadequate for a 4-parameter mutating tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 4 parameters, so the description must compensate and largely does not. It conveys the semantics of 'password' (it must be the correct one) but leaves input_path, output_path, and especially the write-affecting 'overwrite' flag entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Remove the password from a PDF') plus the precondition ('given its correct password'), so the agent knows exactly what operation this performs. The inverse relationship to the sibling encrypt_pdf is evident, though it is never named explicitly, which keeps this from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Given its correct password' defines the condition for use, and 'Not a cracker' explicitly defines when NOT to use it (unknown/forgotten passwords). It offers no alternative route for the password-unknown case, so it falls just short of full when/when-not/alternatives coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_pagesC
Delete pages, e.g. pages="2,5-7".
| Name | Required | Description | Default |
|---|---|---|---|
| pages | Yes | ||
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden but only says 'delete'. It does not disclose that pages are permanently removed, whether the operation is in-place or requires an output_path, or how password-protected PDFs are handled โ significant gaps for a destructive mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence is front-loaded and waste-free, but it is under-specified rather than genuinely concise โ the brevity comes at the cost of missing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter destructive tool with no annotations and no output schema, the description is far too thin. It should cover the output_path/overwrite interplay and the password parameter, none of which are explained anywhere.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters. The description adds a useful page-range syntax example ('2,5-7') that the schema lacks, but leaves password, overwrite, input_path, and output_path entirely undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Delete pages'), which is unambiguous against siblings like extract_pages or rearrange_pages. However, it does not explicitly differentiate itself from those adjacent tools, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of when to prefer extract_pages or rearrange_pages. The agent must infer the use case purely from the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
encrypt_pdfA
Add a password to a PDF.
user_password opens the file; owner_password (defaults to it) controls permissions. algorithm: AES-256 (default), AES-128, RC4-128, RC4-40. allow_print/copy/modify set viewer-enforced restrictions. Use current_password if the input is already encrypted.
| Name | Required | Description | Default |
|---|---|---|---|
| algorithm | No | AES-256 | |
| overwrite | No | ||
| allow_copy | No | ||
| input_path | Yes | ||
| allow_print | No | ||
| output_path | No | ||
| allow_modify | No | ||
| user_password | Yes | ||
| owner_password | No | ||
| current_password | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does well on security semantics -- clarifying that owner_password defaults to user_password and that allow_* are only viewer-enforced restrictions, which is important caveating. But it never says whether the file is modified in place or written to output_path, what overwrite controls, or what happens on a wrong current_password, leaving real gaps for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded one-line statement of the action, followed by tight clauses that each map to a parameter group. Every phrase carries information; there is no filler or repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter file-mutating tool with no annotations and no output schema, the description covers password semantics well but omits where the result is written and how overwrite/output_path interact. An agent still lacks enough to predict side effects on the input file.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it largely does: it explains user_password vs owner_password vs current_password, enumerates all four algorithm values with the default, and characterizes the allow_print/copy/modify flags. Only input_path, output_path, and overwrite go unexplained, which keeps it short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource -- 'Add a password to a PDF' -- which unambiguously identifies the operation and implicitly separates it from the sibling decrypt_pdf. No ambiguity about which tool this is or what it produces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The tool name and opening sentence make the general usage obvious, and 'Use current_password if the input is already encrypted' is a useful conditional. However, there is no explicit 'use decrypt_pdf to remove a password' routing, and no statement of when this tool should not be used. Usage is implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extract_pagesC
Save only the given pages as a new PDF, e.g. pages="1-3,10".
| Name | Required | Description | Default |
|---|---|---|---|
| pages | Yes | ||
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that a new PDF is created, but says nothing about password handling, overwrite behavior, output path defaults, or whether the input file is modified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with a useful inline example and no wasted words. Its brevity is appropriate structurally, even though other dimensions reveal missing detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter, no-annotation, no-output-schema tool that creates a new file, the description is too thin. It omits key operational details such as output location behavior, overwrite handling, and password requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only documents the pages format with an example. It does not explain input_path, output_path, password, or overwrite semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: saving only selected pages as a new PDF. It is clear what the tool does, though it does not explicitly distinguish itself from siblings such as split_pdf or delete_pages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies extraction via "Save only the given pages," but gives no explicit guidance on when to use this instead of delete_pages, rearrange_pages, or split_pdf. There are no exclusions or alternative-selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extract_textB
Extract text from all pages or a page spec (e.g. "1-3,7"). Returns text + truncation flag.
| Name | Required | Description | Default |
|---|---|---|---|
| pages | No | ||
| password | No | ||
| max_chars | No | ||
| input_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries more burden but does disclose the return shape: text plus a truncation flag. It does not explain password handling, truncation conditions, or limits beyond that, leaving meaningful behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the action and followed by useful return information. There is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, no annotations, no output schema, and 0% schema description coverage, the description is too sparse. It omits password behavior, max_chars/truncation details, and any error or permission context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It clarifies only the 'pages' parameter with an example ('1-3,7') and does not explain password, max_chars, or input_path semantics beyond what the bare schema names imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Extract text' from pages. It also clarifies scope with 'all pages or a page spec,' but it does not explicitly distinguish the tool from siblings such as extract_pages, which could also involve page selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool by saying it extracts text from all pages or a page spec. However, it gives no explicit guidance on when to choose this over extract_pages or other sibling tools, and no exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
flatten_pdfC
Flatten form fields and annotations into page content (requires the qpdf CLI).
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses a hard external dependency (qpdf CLI) and implies a lossy, irreversible transformation (interactive fields become static content), but says nothing about in-place modification, password handling, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the operation front-loaded and no padding. It is efficient, though arguably too terse given the undocumented parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter mutation tool with no annotations, no output schema, and 0% schema description coverage, the description is substantially incomplete. It never addresses output location defaults, overwrite semantics, or password-protected inputs, all of which determine correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across four parameters, and the description mentions none of them. Nothing explains input_path vs output_path, what overwrite controls, or that password unlocks encrypted input, so the description provides zero compensation for the documentation gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (flatten) and the exact resources affected (form fields and annotations into page content). It is unambiguous and easily distinguished from siblings like encrypt_pdf or optimize_pdf, though it does not explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus alternatives such as optimize_pdf or convert_to_pdf, nor any stated preconditions beyond the CLI dependency. The agent must infer usage entirely from the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_metadataC
Read document metadata: title, author, subject, keywords, creator, producer.
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | ||
| input_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. 'Read' implies non-destructive access, but there is no mention of password-protected files, failure modes for malformed PDFs, or what happens with missing metadata keys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence, front-loaded with the verb and resource, with the field list as useful detail. No filler, though it is arguably too sparse for a 2-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 0% schema coverage, no annotations, and no output schema, the description should at minimum explain input_path and note password support for encrypted documents. The return-field list is helpful context but the input contract is undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate and does not: neither the required input_path nor the optional password parameter is explained. The listed items are return values, not parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Read document metadata') and enumerates the exact fields returned, which helps an agent know what it gets. However, it does not differentiate from the sibling pdf_info, which plausibly overlaps in purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no mention of alternatives such as pdf_info or set_metadata. The agent must infer from the tool name alone whether this or pdf_info is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
images_to_pdfC
Combine images into a single PDF, one image per page, in order.
| Name | Required | Description | Default |
|---|---|---|---|
| overwrite | No | ||
| input_paths | Yes | ||
| output_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and only discloses page order and one-image-per-page layout. It does not explain overwrite behavior, supported image formats, or what happens when the output path already exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. The key operation and ordering behavior are stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a file-creating tool with no annotations, no output schema, and 0% parameter description coverage, the definition is too sparse. It omits overwrite semantics, supported formats, error behavior, and return expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it never names or explains input_paths, output_path, or overwrite. It only weakly implies that input image order matters and that the output is a single PDF.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: combine images into a single PDF. It also adds ordering and page layout, which helps distinguish it from generic conversion or PDF merging, though it does not explicitly name the relevant siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used for image-to-PDF creation, but it gives no explicit when-to-use guidance, prerequisites, or comparison to alternatives such as convert_to_pdf or merge_pdfs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
merge_pdfsB
Merge PDFs in the given order into output_path.
passwords optionally maps an input path to its password for encrypted inputs.
| Name | Required | Description | Default |
|---|---|---|---|
| overwrite | No | ||
| passwords | No | ||
| input_paths | Yes | ||
| output_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses the ordering guarantee and that passwords apply to encrypted inputs, but it omits the critical mutation semantics: what happens when output_path already exists (the overwrite parameter is never mentioned), and whether inputs are modified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action and output target, followed by the less common password case. Nothing is padded, though the second sentence could be folded in for tighter structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter file-mutating tool with no annotations and no output schema, the description covers the primary flow and the encrypted-input case but leaves the overwrite behavior and the failure/return expectations unstated. A reader can call it, but not confidently predict side effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does explain input ordering, output_path, and the passwords map ('maps an input path to its password') beyond the bare schema. However, the overwrite parameter is left completely undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Merge PDFs') plus the destination ('into output_path') and a meaningful behavioral detail (order is preserved). The action is unambiguous and clearly distinct from siblings like split_pdf or extract_pages, though it never names or contrasts those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no routing to or away from alternatives such as images_to_pdf or convert_to_pdf. The only situational hint is the implicit note that passwords are needed for encrypted inputs, which is a parameter detail rather than usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
optimize_pdfC
Shrink a PDF: linearize ("fast web view") and recompress object streams.
| Name | Required | Description | Default |
|---|---|---|---|
| compress | No | ||
| password | No | ||
| linearize | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it only describes what the transformation does. It doesn't state whether the operation is destructive (the overwrite param and output_path handling suggest in-place vs. copy behavior that is never explained), whether a password is needed for encrypted inputs, or what happens on failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is appropriately terse, though the brevity contributes to the underspecification captured in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with 6 parameters, no annotations, no output schema, and 0% schema coverage, the description is far too thin. An agent lacks the information needed to call it correctly (password handling, overwrite/output behavior).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, and the description only touches on two of them indirectly (linearize, compress). It says nothing about password, overwrite, input_path, or output_path semantics, leaving the challenge of handling password-protected or in-place edits unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Shrink a PDF') and names the two operations (linearize, recompress), which distinguishes it from siblings like repair_pdf or flatten_pdf. However, it doesn't explicitly differentiate itself from those tools, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as repair_pdf, flatten_pdf, or encrypt_pdf. There are no prerequisites, no exclusions, and no routing cues for the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pdf_infoA
Report page count, file size, PDF version, encryption status and metadata.
Works on an encrypted file without a password (returns is_encrypted only).
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | ||
| input_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses a genuinely useful non-obvious behavior (operates on encrypted files without a password, returning is_encrypted only), but it omits the read-only/non-destructive safety profile, error behavior on corrupt files, and any cost/perf notes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the primary purpose and return fields, then the encryption caveat. Every sentence earns its place; nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description does the necessary work by listing what is returned and how encryption is handled. It is nearly complete for a simple inspection tool; the only gap is the safety/destructiveness profile and unmentioned input_path semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds real meaning for the password parameter by explaining it is not required to read encryption status, but input_path is left entirely unexplained and the password's exact effect on other returned fields is not clarified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Report) and resource (PDF info) and enumerates the exact fields returned (page count, file size, version, encryption status, metadata). This clearly separates it from extract_text or manipulation siblings, but it does not explicitly distinguish itself from the closest siblings get_metadata and check_pdf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage for inspecting a PDF without modifying it, and it gives one useful conditional ('works on an encrypted file without a password'). However, it never states when to pick this over get_metadata or check_pdf, which overlap heavily in the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rearrange_pagesA
Reorder/duplicate/reverse pages. page_order e.g. "3,1,2", "5-1" (reverse), "last,1-4".
Unlisted pages are dropped unless append_unlisted=true. Pages may repeat to duplicate.
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| page_order | Yes | ||
| output_path | No | ||
| append_unlisted | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose two important behaviors โ unlisted pages are dropped unless append_unlisted=true, and repeated pages duplicate content โ but says nothing about overwrite semantics, password handling, or where output is written for a tool that mutates/creates files.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place, with the core action front-loaded and the syntax example and drop behavior following immediately. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with no annotations and no output schema, the description covers the critical page_order and append_unlisted semantics but omits the overwrite/output_path behavior that determines where results land and whether the input is modified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, but the description compensates well for the most complex one, page_order, with concrete syntax examples ('3,1,2', '5-1', 'last,1-4') and explains append_unlisted. It leaves password, overwrite, input_path, and output_path entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States specific actions (reorder/duplicate/reverse) on a specific resource (pages), which clearly distinguishes it from siblings like delete_pages, extract_pages, and rotate_pages. An agent can tell what it does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the actions described, but there is no explicit when-to-use guidance or comparison to alternatives such as extract_pages (subset selection) or rotate_pages. The agent must infer the selection criteria from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repair_pdfC
Rebuild a damaged PDF's structure by reading and rewriting it.
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden but only discloses the mechanism ('reading and rewriting'). It says nothing about whether the original file is modified, how failures on irreparable PDFs are handled, or permission/error behavior โ significant gaps for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the operation and mechanism come first. It is efficient, though arguably too terse for a four-parameter mutation tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter mutation tool with no annotations and no schema descriptions, the description omits parameter meaning, side effects, and success/failure behavior. It is not complete enough for an agent to call it correctly without guessing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description explains none of the four parameters. It never mentions input_path, output_path, overwrite, or password, nor the interaction between output_path and overwrite, so it adds no parameter meaning at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: rebuild/repair a damaged PDF's structure, and adds the mechanism ('reading and rewriting'). An agent can tell this is a repair operation rather than extraction or optimization. It stops short of differentiating from near-siblings like check_pdf or optimize_pdf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Damaged PDF' implicitly signals the trigger condition, so usage is inferable. However, it gives no explicit when-to-use guidance, no note about first diagnosing with check_pdf, and no alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rotate_pagesC
Rotate pages clockwise by 90/180/270 degrees (all pages if pages omitted).
| Name | Required | Description | Default |
|---|---|---|---|
| pages | No | ||
| degrees | Yes | ||
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses rotation direction and default scope, but says nothing about whether the source file is modified, how `overwrite` and `output_path` interact, or that password-protected PDFs require `password`.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the core operation front-loaded and the default-scope caveat tucked into a parenthetical. Every clause carries information; nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with six undocumented parameters, no annotations, and no output schema, the description is too thin. It covers the rotation itself but leaves file I/O, overwrite semantics, and encryption handling entirely to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across six parameters, so the description must compensate and does so only partially. It clarifies `degrees` (allowed 90/180/270) and the default behavior of `pages`, but `input_path`, `output_path`, `password`, and `overwrite` are left completely undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (rotate), resource (pages), and direction (clockwise), so there is no ambiguity about the operation. It does not explicitly contrast with siblings like rearrange_pages or extract_pages, but 'rotate' is distinct enough in this set that an agent can route to it without confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage detail is the parenthetical that omitting `pages` rotates all pages, which is really a default-value statement, not guidance. There is no mention of when to prefer this over rearrange_pages, nor prerequisites such as needing a password for encrypted inputs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_metadataC
Set metadata. fields keys: title, author, subject, keywords, creator, producer.
| Name | Required | Description | Default |
|---|---|---|---|
| fields | Yes | ||
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden and does not meet it. It never says whether metadata is written in place or to output_path, what happens to existing tags by default, how 'overwrite' behaves, or that password-protected files require a password.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded and free of filler, but brevity here shades into under-specification rather than disciplined concision. The allowed-keys sentence is the only content-bearing part.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter mutation tool with a nested object, zero schema descriptions, no annotations, and no output schema, this is thin. The allow-list of metadata keys is helpful, but write semantics, path handling, and password/overwrite behavior are all missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for 5 parameters, so the description must compensate and largely fails. It usefully enumerates the permitted keys inside 'fields', but says nothing about input_path, output_path, overwrite, or password, or the in-place-vs-copy behavior they imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
'Set metadata' names a specific verb and resource, and the sibling set (get_metadata, pdf_info) makes the read/write distinction inferable. It does not explicitly contrast itself with get_metadata, but the operation is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No statement of when to use this versus get_metadata or pdf_info, no prerequisites (e.g., needing to read metadata first, or encryption requirements). The agent must infer usage entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
split_pdfB
Split a PDF into several files.
ranges: semicolon-separated page specs, one file each, e.g. "1-3;4-6;7-". If omitted, every page becomes its own file.
| Name | Required | Description | Default |
|---|---|---|---|
| ranges | No | ||
| password | No | ||
| overwrite | No | ||
| input_path | Yes | ||
| output_dir | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It states output cardinalityโone file per range, otherwise one file per pageโbut omits overwrite behavior, password handling, output naming, and whether the original file is modified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, front-loaded, and includes a concrete example. Every sentence supports range formatting or default behavior, with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter tool with no annotations, no output schema, and zero schema descriptions, the definition is incomplete. It covers the most distinctive parameter but leaves overwrite/password/output behavior and error expectations unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only documents the ranges parameter, including its semicolon syntax and default. It does not explain password, overwrite, input_path, or output_dir semantics, leaving most parameters to inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "Split a PDF into several files." That lets an agent distinguish it from merge_pdfs and extract_pages by the multiple-output outcome, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains the ranges format and the default when ranges is omitted, which helps with invocation. However, it does not state when to choose split_pdf over extract_pages or merge_pdfs, nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
18 tool updates
v0.1.0- First observed
check_pdf - First observed
convert_to_pdf - First observed
decrypt_pdf - First observed
delete_pages - First observed
encrypt_pdf - First observed
extract_pages - First observed
extract_text - First observed
flatten_pdf - First observed
get_metadata - First observed
images_to_pdf - First observed
merge_pdfs - First observed
optimize_pdf - First observed
pdf_info - First observed
rearrange_pages - First observed
repair_pdf - First observed
rotate_pages - First observed
set_metadata - First observed
split_pdf
TDQS
Scored across 18 tools
Most tools target a distinct operation (encrypt vs decrypt, merge vs split, rotate vs rearrange), so boundaries are usually clear. Minor overlaps exist: pdf_info already reports metadata that get_metadata reads, and convert_to_pdf can create a PDF from an image, which images_to_pdf also does.
Nearly all names use a consistent snake_case verb_noun pattern (extract_text, merge_pdfs, rotate_pages, set_metadata). The lone deviation is pdf_info, which puts the noun first, but it stays readable and in the same casing convention.
18 tools is on the heavier side but each covers a genuinely distinct PDF task (metadata, security, page ops, merge/split, optimize, repair, flatten, conversion). No tool feels redundant enough to remove, so the count is justified by the breadth of the domain.
The surface covers the full lifecycle well: inspect, validate, read/write metadata, encrypt/decrypt, page manipulation, merge/split, optimize, repair, flatten, and conversion. Only niche operations like image extraction or watermarking are absent, which agents can work around.
Related MCP Connectors
PDF tools for AI agents: validate, extract, merge, split, compress, OCR, sign and redact.
13 stateless PDF tools for AI agents: merge, split, rotate, compress, watermark, redact, flatten, repair, add page numbers and fill PDF forms. Files are processed in memory and nothing is stored. Part of FreeDailyPro's 211+ MCP tools; trial key with 20,000 calls/month at freedailypro.com/developers.
File tools for your AI chat: PDF tables to Excel, merge PDFs, images to PDF, fill PDF forms.
Merge, split, extract, rotate, reorder and stamp PDF pages from your AI chat, all offline.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceEnables AI agents to perform 13 PDF operations (merge, split, compress, watermark, encrypt, and more) on local files via MCP.3-
- AlicenseCqualityDmaintenanceEnables AI assistants to perform PDF operations like merge, split, compress, convert, encrypt, OCR, and summarize using natural language.988 npmMIT
- AlicenseBqualityBmaintenanceEnables AI agents to perform local-first PDF processing entirely on-device, including OCR write-back to make scans searchable, unlocking and re-encrypting PDFs, splitting/merging/rotating pages, and compressing files, with no cloud calls or file uploads.2532 PyPI1MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to edit text inside real PDF files in place while preserving fonts and layout, with a before/after preview. Also supports compressing, merging, splitting, converting, translating, generating and querying PDFs through a hosted remote MCP endpoint.MIT