PdfmuxBLOCK
PDF extraction that audits its own output — and certifies any other extractor's, catching pages they silently dropped. Verify signed manifests offline: free, MIT, no account. 0.903 on opendataloader-bench, #2 of 8 engines. 7-tool MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/NameetP/pdfmux/actions/workflows/ci.yml) [](https://pypi.org/project/pdfmux/) [](https://pypi.org/project/pdfmux/) [](https://opensource.org/licenses/MIT) [](https://pypi.org/project/pdfmux/)
Self-healing PDF extraction that flags the pages it can't read instead of dropping them — and now certifies any extractor's output for silent drops. Open-source LlamaParse alternative for RAG pipelines, MCP server for Claude Desktop, LangChain + LlamaIndex loaders.
pdfmux extracts PDFs and checks its own work — and now certifies any extractor's, telling you which pages it silently dropped. Free, MIT. Patent-pending method. pip install pdfmux.Two jobs, one tool:
- Self-healing extraction. The only PDF extractor that audits its own output. Catches blank pages, scrambled columns, broken tables — re-extracts them with a stronger backend, and flags what it still can't read instead of silently dropping it. So your LLM gets clean data, not silent garbage. Routes each page to the best of 7 built-in extraction backends + BYOK LLM fallback (Gemini / Claude / GPT-4o / Ollama). One CLI. One API. Zero config.
- Certify Anything — new in v1.8.1.
pdfmux verifyaudits any extraction engine's output against the source PDF — Reducto, Mistral OCR, LlamaParse, Docling, your in-house parser — and tells you which pages it silently dropped. Free, MIT, patent-clean.
PDF ──> pdfmux router ──> best extractor per page ──> audit ──> re-extract failures ──> Markdown / JSON / chunks | ├─ PyMuPDF (digital text,
565088bac444OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add pdfmux --env GEMINI_API_KEY=${GEMINI_API_KEY} -- pdfmux pdfmux==1.8.7Exposed tools (8)
8 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
analyze_pdf | read | Quick PDF triage — classify type and audit page quality without full extraction. Returns page count, type detection, per-page quality breakdown, and estimated extraction difficulty. Much cheaper than convert_pdf for initial assessment. |
batch_convert | read | Convert all PDFs in a directory to Markdown. Returns a summary with per-file results. |
convert_pdf | read | Convert a PDF to AI-readable Markdown. Automatically detects the PDF type and picks the best extraction method. Returns confidence score and warnings when extraction is limited. |
extract_pdf | read | Convert a PDF to AI-readable Markdown. |
extract_streaming | read | Stream extraction events for a PDF as NDJSON. |
extract_structured | read | Extract structured data from a PDF — tables as JSON, key-value pairs, and optionally map to a JSON schema. Returns tables with headers/rows, detected key-value pairs with auto-normalization (dates, amounts, rates), and schema-mapped output if a schema is provided. |
get_pdf_metadata | read | Get PDF metadata instantly — page count, file size, document type, and whether it has tables. No extraction performed. Use this first to decide which tool to call next: convert_pdf for full text, analyze_pdf for quality audit, or extract_structured for tables. |
verify_extraction | read | Audit an extraction of a PDF for silently-dropped pages — the failure where an extractor returns nothing for a page that has real text while reporting success. Pass extracted_text with another engine |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (22)
"169.254.169.254", # AWS / OpenStack / Azure IMDS
"metadata.google.internal", # GCP
importlib.import_module(import_name)
mod = importlib.import_module(import_name)
.pdfmux.example.yaml
"169.254.169.254", # cloud metadata
3�<��4\88���h=� �%�͞�pe������hvfd3d9fQVNGSolSRneRQ0dGdHRUcIJvekCPmKKtj7NweGtjSEJre2FlV3J/UGBwL2ZtMSIkYGkIHx0aJmNiVCNMARdOHxsIGzVQZ0F8Q0U2ZkQlV3lMbF5tcUVlL2Btv1tMUWBqRGNMcXVVdzhePRokJzgBZiN9c3ETZS9hMR1
3�<��4\88���h=� �%�͞�pe������hvfd3d9fQVNGSolSRneRQ0dGdHRUcIJvekCPmKKtj7NweGtjSEJre2FlV3J/UGBwL2ZtMSIkYGkIHx0aJmNiVCNMARdOHxsIGzVQZ0F8Q0U2ZkQlV3lMbF5tcUVlL2Btv1tMUWBqRGNMcXVVdzhePRokJzgBZiN9c3ETZS9hMR1
3�<��4\88���h=� �%�͞�pe������hvfd3d9fQVNGSolSRneRQ0dGdHRUcIJvekCPmKKtj7NweGtjSEJre2FlV3J/UGBwL2ZtMSIkYGkIHx0aJmNiVCNMARdOHxsIGzVQZ0F8Q0U2ZkQlV3lMbF5tcUVlL2Btv1tMUWBqRGNMcXVVdzhePRokJzgBZiN9c3ETZS9hMR1
_PNG_1X1 = base64.b64decode(
return Ed25519PublicKey.from_public_bytes(base64.b64decode(material))
key.verify(base64.b64decode(signature), canonical_bytes(manifest))
���������?����������������������������������������������������������������%��������������������������������������?$% !### ���������������������������"��������
����������?����������������������������������������������������������������)�����������������������������������������������?$) !### ���������������������������"��������
���������?����������������������������������������������������������������%��������������������������������������?$% !### ���������������������������"��������
����������?����������������������������������������������������������������)�����������������������������������������������?$) !### ���������������������������"��������
���������?����������������������������������������������������������������%��������������������������������������?$% !### ���������������������������"��������
eval/fixtures/edge-image-only-00.pdf
eval/fixtures/edge-image-only-01.pdf
eval/fixtures/edge-image-only-02.pdf
eval/fixtures/edge-image-only-03.pdf
eval/fixtures/edge-image-only-04.pdf
Gates applied: no_behavioural_pass.
565088bac444full audit observations/trust-audit/mcp-server/nameetp__pdfmux.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 565088bac444 | BLOCK | D | 69 | first audit |
Questions
What is the Pdfmux MCP server?
PDF extraction that audits its own output — and certifies any other extractor's, catching pages they silently dropped. Verify signed manifests offline: free, MIT, no account. 0.903 on opendataloader-bench, #2 of 8 engines. 7-tool MCP server.
What tools does Pdfmux expose?
8 in total: 8 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Pdfmux safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Pdfmux need?
It reads ANTHROPIC_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, MISTRAL_API_KEY, OPENAI_API_KEY, PDFMUX_MAX_PASSES, PDFMUX_REMOTE_SIGNING_KEY and PDFMUX_REMOTE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Pdfmux run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as pdfmux-mcp at 1.4.0.
How current is this page?
The grade is for one exact copy of the source (565088bac444), read on 2026-10-07. The repository is watched and re-audited when it changes.