CalibreBLOCK
Calibre library automation via FastMCP — metadata, shelves, RAG-friendly export. Companion to Calibre, not a replacement. For Cursor / Claude Desktop.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
📖 Installation Guide — download the .exe from Releases, double-click, doneFastMCP 3.2 MCP server for Calibre e-book library management — AI-assisted search, RAG, and agentic workflows for Sandra's 1000+ book library.
Quick Start
Download *`Calibre MCP__x64-setup.exe` from [Releases](https://github.com/sandraschi/calibre-mcp/releases/latest) → double-click → launch Calibre MCP**. Install guide.
Developers from source:
git clone https://github.com/sandraschi/calibre-mcp cd calibre-mcp just sync just start-webapp
// claudedesktopconfig.json { "mcpServers": { "calibre-mcp": { "command": "uv", "args": ["run", "calibre-mcp"],
f57903aa666aOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add calibre-webapp-frontend --env CALIBRE_ADMIN_PASSWORD=${CALIBRE_ADMIN_PASSWORD} --env CALIBRE_PASSWORD=${CALIBRE_PASSWORD} --env LLM_API_KEY=${LLM_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"calibre-webapp-frontend": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CALIBRE_ADMIN_PASSWORD": "${CALIBRE_ADMIN_PASSWORD}",
"CALIBRE_PASSWORD": "${CALIBRE_PASSWORD}",
"LLM_API_KEY": "${LLM_API_KEY}",
"OPENAI_API_KEY": "${OPENAI_API_KEY}"
}
}
}
}Exposed tools (51)
48 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agentic_calibre_workflow | write | Execute agentic Calibre workflows using FastMCP 2.14.3 sampling with tools. |
agentic_library_workflow | read | |
analyze_library | read | |
analyze_library_health | read | |
calibre_metadata_export_json | read | |
calibre_metadata_index_build | read | |
calibre_metadata_search | read | |
calibre_rag | read | |
conversational_calibre_assistant | read | Conversational Calibre assistant with natural language responses. |
find_duplicate_books | read | |
get_series_analysis | read | |
get_tag_statistics | read | |
help_tool | read | |
intelligent_library_processing | read | Intelligent batch book processing using FastMCP 2.14.3 sampling with tools. |
library_discovery | read | |
manage_ai_operations | read | |
manage_analysis | read | |
manage_books | read | |
manage_bulk_operations | read | |
manage_comments | read | |
manage_content_sync | write | |
manage_descriptions | read | |
manage_extended_metadata | read | |
manage_files | read | |
manage_import | write | |
manage_libraries | read | |
manage_library_operations | read | |
manage_metadata | read | |
manage_organization | read | |
manage_publishers | read | |
manage_series | read | |
manage_smart_collections | read | |
manage_system | read | |
manage_tags | read | |
manage_times | read | |
manage_user_comments | read | |
manage_users | read | |
manage_viewer | read | |
media_critical_reception | read | |
media_deep_research | read | |
media_research_book | read | |
media_synopsis | read | |
rag_index_build | read | |
rag_retrieve | read | |
reading_statistics | read | |
search_fulltext | read | |
show_api_docs | read | |
show_book_prefab_card | read | |
show_libraries_prefab_card | read | |
test_tool | read | A simple test tool |
unread_priority_list | read |
Trust audit
BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (11 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
.env
content = re.sub(r'pickle\.load\(f\) # noqa: S301', 'pickle.load(f) # noqa: S301', content) # already done
content = re.sub(r'(?<! # noqa: S301)pickle\.load\(f\)', 'pickle.load(f) # noqa: S301', content)
content = re.sub(r'pickle\.load\(f\)(?!.*noqa)', 'pickle.load(f) # noqa: S301', content)
Add-Noqa "$src\calibre_mcp\config_discovery.py" '(?m)pickle\.load\(f\)' 'pickle.load(f) # noqa: S301'
$content = $content -replace 'lib_infos = pickle\.load\(f\)', 'lib_infos = pickle.load(f) # noqa: S301'
Add-Noqa "$src\calibre_mcp\tools\base_tool.py" 'exec\(exec_code, exec_globals, local_vars\)' 'exec(exec_code, exec_globals, local_vars) # noqa: S102'
$content = $content -replace 'exec\(exec_code, exec_globals, local_vars\)', 'exec(exec_code, exec_globals, local_vars) # noqa: S102'
os.environ.copy() ... urllib.request
calibre_mcp_integration.zip
extension.wasm
0-10f849fb-facd-4086-93a1-555793a5a107.txn
1-ade67a8f-9cf1-4ad9-a371-7a64919e44a9.txn
18446744073709551613.manifest
scripts/backup-repo.ps1
module = importlib.import_module(f"calibre_mcp.tools.{name}")mod = importlib.import_module(entry_module_or_file)
__import__(module_name)
module = importlib.import_module(f"calibre_mcp.tools.{name}")def _update_progress(self, callback_url: str | None, current: int, total: int, message: str) -> None:
if not callback_url:
callback_url,
def _update_progress(self, callback_url: str | None, current: int, total: int, message: str) -> None:
if not callback_url:
{Gates applied: no_behavioural_pass.
f57903aa666afull audit observations/trust-audit/mcp-server/sandraschi__calibre-4.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f57903aa666a | BLOCK | F | 38 | first audit |
Questions
What is the Calibre MCP server?
Calibre library automation via FastMCP — metadata, shelves, RAG-friendly export. Companion to Calibre, not a replacement. For Cursor / Claude Desktop.
What tools does Calibre expose?
51 in total: 48 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Calibre safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (38/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Calibre need?
It reads CALIBRE_ADMIN_PASSWORD, CALIBRE_PASSWORD, LLM_API_KEY, OPENAI_API_KEY and SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Calibre run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as calibre-webapp-frontend at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (f57903aa666a), read on 2026-10-08. The repository is watched and re-audited when it changes.