← Back to search

@modelcontextprotocol/server-pdf

ochafik-ant Scanned 20d ago

MCP App example demonstrating lazy (on-demand) OAuth: public tools work unauthenticated, protected tools return 401 + WWW-Authenticate so the host runs the OAuth flow only when needed

C
66.4 / 100

Versions

1.7.5latest
Jul 23, 2026
1.7.4
Jun 5, 2026
1.7.3
Jun 1, 2026
1.7.2
May 15, 2026
1.7.1
Apr 27, 2026
+ show 17 moreshow less
1.7.0
Apr 21, 2026
1.6.0
Apr 14, 2026
1.5.0
Apr 2, 2026
1.4.0
Apr 2, 2026
1.3.2
Mar 27, 2026
1.3.1
Mar 23, 2026
1.3.0
Mar 23, 2026
1.2.2
Mar 10, 2026
1.2.1
Mar 10, 2026
1.2.0
Mar 6, 2026
1.1.2
Feb 25, 2026
1.1.1
Feb 24, 2026
1.1.0
Feb 22, 2026
1.0.1
Jan 26, 2026
1.0.0
Jan 26, 2026
0.4.2
Jan 26, 2026
0.4.1
Jan 15, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 16

generate_qr
annotations: none low

Generate a QR code from text. Args: text: The text/URL to encode box_size: Size of each box in pixels (default: 10) border: Border size in boxes (default: 4) error_correction: Error correction level - L(7%), M(15%), Q(25%), H(30%) fill_color: Foreground color (hex like #FF0000 or name like red) back_color: Background color (hex like #FFFFFF or name like white)

text str border int box_size int back_color str fill_color str error_correction str
list_voices
annotations: none low

List available TTS voices. Returns the predefined voice names that can be used with the say tool. You can also use HuggingFace URLs (hf://kyutai/tts-voices/...) or local file paths.

say
annotations: none low

Speak English text aloud using text-to-speech. Use when the user wants text read or spoken aloud: - "say ...", "speak ...", "read ... out loud" - "...; say it", "...; read it to me", "...; speak it" - "narrate ...", "read this aloud" Audio streams in real-time as text is provided. Use list_voices() for voice options. Note: English only. Non-English text may produce poor or garbled results.

text string voice string autoPlay string
create_tts_queue
annotations: none low

Create a TTS generation queue. Returns queue_id and sample_rate. Args: voice: Voice to use (cosette, alba, brenda, etc.)

voice str
add_tts_text
annotations: none low

Add text to a TTS queue. Args: queue_id: The queue ID from create_tts_queue text: Text to add (incremental, not cumulative)

text str queue_id str
end_tts_queue
annotations: none low

Signal that no more text will be sent to a queue. Args: queue_id: The queue ID from create_tts_queue

queue_id str
cancel_tts_queue
annotations: none low

Cancel and cleanup a TTS queue. Use before creating a new queue to avoid overlapping playback. Args: queue_id: The queue ID from create_tts_queue

queue_id str
poll_tts_audio
annotations: none low

Poll for available audio chunks from a TTS queue. Returns base64-encoded audio chunks with timing metadata. Call repeatedly until done=true. Args: queue_id: The queue ID from create_tts_queue

queue_id str
weather
annotations: none low

Get weather forecast

learn_threejs
annotations: none low

Get documentation and examples for using the Three.js View

revoke_auth_token
annotations: none low

Protected tool: revokes the caller's entire auth session (access + refresh token).

elicit_url
annotations: none low

URL elicitation via elicitInput. Blocks until the client accepts; sends ElicitCompleteNotification before returning.

elicit_by_error
annotations: none low

Throws UrlElicitationRequiredError (-32042). Client must open the URL, then retry. On retry, if the last-issued elicitationId was completed, sends ElicitCompleteNotification and succeeds.

geocode
annotations: none low

Search for places using OpenStreetMap. Returns coordinates and bounding boxes for up to 5 matches.

interact
annotations: none low

Interact with a PDF viewer: annotate, navigate, search, extract text/screenshots, fill forms. IMPORTANT: viewUUID must be the exact UUID returned by display_pdf (e.g. "a1b2c3d4-..."). Do NOT use arbitrary strings. **BATCHING**: Send multiple commands in one call via \

list_pdfs
annotations: none low

List available PDFs that can be displayed

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, os, pathlib
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 71

low
Tool 'list_pdfs' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 146 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
low
Tool 'generate_qr' has no annotations annotation_checker · 100%
low
Tool 'list_voices' has no annotations annotation_checker · 100%
low
Tool 'say' has no annotations annotation_checker · 100%
low
Tool 'create_tts_queue' has no annotations annotation_checker · 100%
low
Tool 'add_tts_text' has no annotations annotation_checker · 100%
low
Tool 'end_tts_queue' has no annotations annotation_checker · 100%
low
Tool 'cancel_tts_queue' has no annotations annotation_checker · 100%
low
Tool 'poll_tts_audio' has no annotations annotation_checker · 100%
low
Tool 'weather' has no annotations annotation_checker · 100%
low
Tool 'learn_threejs' has no annotations annotation_checker · 100%
low
Tool 'revoke_auth_token' has no annotations annotation_checker · 100%
low
Tool 'elicit_url' has no annotations annotation_checker · 100%
low
Tool 'elicit_by_error' has no annotations annotation_checker · 100%
low
Tool 'geocode' has no annotations annotation_checker · 100%
low
Tool 'interact' has no annotations annotation_checker · 100%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: systeminformation@5.31.6 (GHSA-5xpp-75jx-m839) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@5.0.0 (GHSA-crpf-4hrx-3jrp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@5.0.0 (GHSA-f7gr-6p89-r883) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@5.0.0 (GHSA-m56q-vw4c-c2cp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@5.0.0 (GHSA-phwv-c562-gvmh) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@5.0.0 (GHSA-pr6f-5x2q-rwfp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@5.0.0 (GHSA-rcqx-6q8c-2c42) dependency_analyzer · 95%
medium
Buffer.from base64 in modelcontextprotocol-ext-apps-10195ad/scripts/typedoc-plugin-seo.mjs:270 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-ext-apps-10195ad/examples/pdf-server/server.ts:1869 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-ext-apps-10195ad/examples/pdf-server/server.ts:1890 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-ext-apps-10195ad/examples/pdf-server/server.ts:2331 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-ext-apps-10195ad/examples/pdf-server/server.ts:2882 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in modelcontextprotocol-ext-apps-10195ad/examples/pdf-server/server.test.ts:1358 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: generate_qr manifest_parser · 90%
info
Tool: list_voices manifest_parser · 90%
info
Tool: say manifest_parser · 90%
info
Tool: create_tts_queue manifest_parser · 90%
info
Tool: add_tts_text manifest_parser · 90%
info
Tool: end_tts_queue manifest_parser · 90%
info
Tool: cancel_tts_queue manifest_parser · 90%
info
Tool: poll_tts_audio manifest_parser · 90%
info
Tool: weather manifest_parser · 85%
info
Tool: learn_threejs manifest_parser · 85%
info
Tool: revoke_auth_token manifest_parser · 85%
info
Tool: elicit_url manifest_parser · 85%
info
Tool: elicit_by_error manifest_parser · 85%
info
Tool: geocode manifest_parser · 85%
info
Tool: interact manifest_parser · 85%
info
Tool: list_pdfs manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (18) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 658 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%