← Back to search

io.github.cyanheads/docgen-mcp-server

cyanheads Scanned 22d ago

Render HTML/markdown to PDF, export rows to xlsx, and fill AcroForm PDFs.

B
87.4 / 100

Versions

0.2.0latest
first seen Jun 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 4

docgen_fill_form
annotations: verified low

Fill the AcroForm fields of a supplied PDF and optionally flatten it. Provide the source PDF as exactly one of { base64 } or { url } (an https URL fetched behind an SSRF guard; base64 avoids any fetch), plus a fields map of AcroForm field name → value. Field names must match the PDF internal names exactly (case-sensitive); obtain them from whoever supplied the form, since docgen does not expose them. Names with no AcroForm counterpart come back in unmatchedFields[] rather than failing — correct them and re-render. Set flatten to bake the values in so the result is no longer editable. Returns a delivery envelope with a documentId, resource URI, pageCount, and inline base64 when small enough.

input object output object
readOnlyHint false openWorldHint false
docgen_get_document
annotations: verified low

Re-fetch a previously rendered document by the id a docgen render/export/fill tool returned. Returns the same delivery envelope (metadata plus resource URI, and inline base64 when small enough). Use it to recover a document whose inline copy was dropped (over the inline size limit) while it is still within its TTL. The documentId is obtainable ONLY from an earlier docgen_render_pdf, docgen_export_spreadsheet, or docgen_fill_form result — it is not guessable, and an expired or unknown id returns document_expired.

input object output object
readOnlyHint true openWorldHint false idempotentHint true
docgen_export_spreadsheet
annotations: verified low

Render one or more named worksheets of row objects to a downloadable .xlsx workbook. Each sheet is a name plus an array of row objects (property → scalar), with an optional column spec controlling header label, value type, width, and number/date format. An empty rows array yields a header-only sheet; provide at least one sheet. Returns a delivery envelope with a documentId, resource URI, sheetCount, byte size, and inline base64 when small enough. The natural export stage for tabular data pulled from another server — reshape its rows into sheets[] and render.

input object engine string output object
readOnlyHint false openWorldHint false
docgen_render_pdf
annotations: verified low

Render content to a downloadable PDF document. Provide exactly one source: { html } (raw HTML you compose — the recommended path), { markdown } (converted to HTML then rendered), or { template, data } (a {{key}} template filled from a data object, server-owned layout). Control page size, orientation, margins, header/footer, and page numbers via pageOptions. Returns a delivery envelope with a documentId, resource URI, pageCount, byte size, and inline base64 when small enough. The lightweight engine renders structured layout (headings, paragraphs, lists, tables) but not arbitrary CSS — a degraded flag is set when unsupported styling is dropped.

input object engine string output object
readOnlyHint false openWorldHint false

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 22

info
Tool 'docgen_fill_form' annotations are consistent annotation_checker · 80%
info
Tool 'docgen_get_document' annotations are consistent annotation_checker · 80%
info
Tool 'docgen_export_spreadsheet' annotations are consistent annotation_checker · 80%
info
Tool 'docgen_render_pdf' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in cyanheads-docgen-mcp-server-1121bb9/tests/tools/document-tools.test.ts:28 entropy_analyzer · 75%
medium
Buffer.from base64 in cyanheads-docgen-mcp-server-1121bb9/tests/tools/document-tools.test.ts:318 entropy_analyzer · 75%
medium
Buffer.from base64 in cyanheads-docgen-mcp-server-1121bb9/src/services/document/document-store.ts:105 entropy_analyzer · 75%
medium
Buffer.from base64 in cyanheads-docgen-mcp-server-1121bb9/src/mcp-server/tools/definitions/fill-form.tool.ts:25 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: docgen_fill_form manifest_parser · 75%
info
Tool: docgen_get_document manifest_parser · 75%
info
Tool: docgen_export_spreadsheet manifest_parser · 75%
info
Tool: docgen_render_pdf manifest_parser · 75%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 16 components sbom_generator · 100%
high
Hardcoded Password found in cyanheads-docgen-mcp-server-1121bb9/framework-skills/api-utils/references/security.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%