ModelsAtlas
Explore
Atlas / MCP servers / sylphxai / PDF Reader

PDF ReaderBLOCK

mcp/sylphxai/pdf-reader-10
MCP server by sylphxai · ai agents · cli · document conversion · Audited 2026-09-26
⚑ Report / re-scanSource ↗

Any file → clean Markdown for AI agents: PDF, Word, PowerPoint, Excel, EPUB, HTML and web pages, images (OCR), audio and video (metadata, subtitles, transcripts). A fast Rust MCP server and CLI that runs on your machine. No API key.

Verdict
BLOCK
Grade
F
Trust score
49 /100
Exposed tools
1 1r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
936
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

anymd

PDF, Word, PowerPoint, Excel, EPUB, HTML and web pages, images (OCR), audio and video (metadata, subtitles, transcripts). A fast Rust MCP server and CLI that runs on your machine. No API key.

[](https://www.npmjs.com/package/@sylphx/anymd) [](https://www.npmjs.com/package/@sylphx/anymd) [](https://github.com/SylphxAI/anymd/stargazers) [](https://registry.modelcontextprotocol.io/v0/servers?search=anymd) [](LICENSE) [](https://github.com/SylphxAI/repomap#agent-readiness-score)

Install · Benchmarks · Tools · CLI · Formats · Docs

Formerly pdf-reader-mcp. Migrating from pdf-reader-mcp

A real, unedited terminal recording (asciinem

Read from source at commit 442f62504eb4OBSERVED · 2026-09-26
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add anymd -- npx -y @sylphx/[email protected]
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
source.csvreadSource data
04

Trust audit

BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (11 observation(s))
Shell
declared (6 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
vendor/pdf-extract/src/lib.rs:1146
fn eval(&self, _input: &[f64], _output: &mut [f64]) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
crates/anymd-core/src/ssrf.rs:165
"169.254.169.254",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
bench/reference/slides-epa-1bp.txt:42
Risk to workers, occupational non-users (ONUs), consumers, and bystanders for 23 of the 25 conditions of use contribute to the unreasonable risk from 1-BP.
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
bench/reference/slides-epa-1bp.txt:43
Timeline:
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
bench/reference/slides-epa-1bp.txt:46
2025: Publication of 1-BP Final Rule (estimated)
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
bench/reference/slides-epa-1bp.txt:59
TSCA provides authority to regulate entities including:
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
bench/reference/slides-epa-1bp.txt:60
Manufacturers (including importers) and processors (e.g., formulators)
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMInventory / provenance · inv.binary · CWE-1104
bench/files/docx-hhs-market-research.docx
docx-hhs-market-research.docx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
bench/files/docx-markitdown.docx
docx-markitdown.docx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
bench/files/docx-nsf-aaac-minutes.docx
docx-nsf-aaac-minutes.docx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
bench/files/epub-markitdown.epub
epub-markitdown.epub
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
bench/files/sheet-ers-crop-insurance.xlsx
sheet-ers-crop-insurance.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/anymd-core/src/read_pdf/tests.rs:265
url: Some("http://127.0.0.1/secret.pdf".into()),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/anymd-formats/src/whisper.rs:639
let unreachable = "http://127.0.0.1:9/none";
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/anymd/src/region_analysis_evidence.rs:38
const DEFAULT_OLLAMA_URL: &str = "http://127.0.0.1:11434/api/generate";
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/anymd/src/region_analysis_evidence.rs:39
const DEFAULT_LMSTUDIO_URL: &str = "http://127.0.0.1:1234/v1/chat/completions";
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/anymd/src/region_analysis_evidence.rs:40
const DEFAULT_LLAMACPP_URL: &str = "http://127.0.0.1:8080/v1/chat/completions";
LOWInventory / provenance · inv.hidden_file · CWE-1104
docs/public/.nojekyll
.nojekyll
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/anymd-core/src/catalog_signals/tests.rs:315
.join("../../test/fixtures/differential/v3014-page-labels-kids-v1.pdf");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/anymd-core/src/form_attachment_signals/tests.rs:40
.join("../../test/fixtures/differential/v3014-behavior-v1.pdf");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/anymd-core/src/form_attachment_signals/tests.rs:638
.join("../../test/fixtures/differential")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/anymd-core/src/form_attachment_signals/tests.rs:688
.join("../../test/fixtures/differential")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/anymd-core/src/form_attachment_signals/tests.rs:732
.join("../../test/fixtures/differential")
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
CHANGELOG.md:146
with `169.254.169.254` (DNS-rebinding / TOCTOU bypass, GHSA-5r2f-7788-qp8v). Adds
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
bench/demo/og-image.html:21
<div class="brand"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxMjggMTI4IiByb2xlPSJpbWciIGFyaWEtbGFiZWw9ImFueW1kIj4KICA8IS0tIENpdHJhIG1hc

Gates applied: no_behavioural_pass.

Audited 2026-09-26 · audit v0.4.1 · source sha 442f62504eb4full audit observations/trust-audit/mcp-server/sylphxai__pdf-reader-10.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-26442f62504eb4BLOCKF49first audit
06

Questions

What is the PDF Reader MCP server?

Any file → clean Markdown for AI agents: PDF, Word, PowerPoint, Excel, EPUB, HTML and web pages, images (OCR), audio and video (metadata, subtitles, transcripts). A fast Rust MCP server and CLI that runs on your machine. No API key.

What tools does PDF Reader expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is PDF Reader safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (49/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does PDF Reader need?

No credential environment variables were found in its source, so it appears to need none.

How does PDF Reader run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @sylphx/anymd-win32-x64-msvc at 8.1.0.

How current is this page?

The grade is for one exact copy of the source (442f62504eb4), read on 2026-09-26. The repository is watched and re-audited when it changes.

Advertisement