PDF Triage

pdf-triage-mcp

[npm] [CI] [MCP Registry] [License: MIT]

An MCP server that lets any AI tool read local PDFs — without uploading them, without an OCR bill, and without silently handing back garbage.

Built on @firecrawl/pdf-inspector (Rust, no ML models, no external services).

┌─ pdf_classify ──→  text_based · 0.98 · 12 pages · 0 need OCR   ~20ms├─ pdf_search  ──→  "invoice total" found on p4, p9              ~150ms├─ pdf_extract ──→  clean Markdown, truncated to your budget     ~150ms└─ pdf_tables  ──→  just the pipe tables, no prose               ~150ms

Table of contents

• Why this exists
• Install
• Connect it to your AI tool — 12 clients
• Tools
• Configuration
• Engine fallback
• Known limitations
• Development

Why this exists

Most PDF tooling has the same failure mode: it returns confident text regardless of whether extraction actually worked. Broken CID fonts, substitution-cipher encodings, scanned pages with no text layer — you get plausible-looking output and find out downstream, if at all.

pdf-inspector is unusually good at knowing when it failed. It emits U+FFFD rather than guessing at an unmapped CID, runs substitution-cipher detection over its own output, and reclassifies a document as scanned when extracted text drops below 50% alphanumeric. But it stops at reporting those findings on a result object — and most wrappers throw them away.

This server acts on them. Every response carries the trust signals, above the content, where the model reads them first:

> [!WARNING] ENCODING ISSUES DETECTED. The text layer decoded to suspicious> output — typically a garbled CID font or a substitution-cipher encoding> where letter frequencies match natural language but the letters themselves> are wrong. Treat all extracted text here as unreliable and prefer OCR.
---
# Quarterly Report...

Three design rules follow:

1. Classify before extracting. pdf_classify costs ~20ms and tells you whether extraction is worth attempting at all.
2. Bound every output. A 300-page PDF is easily 500k tokens. Everything truncates by default and tells you how to page through instead.
3. Confine every path. A model that has just read an untrusted document must not be talkable into reading ~/.ssh/id_rsa. Enforced in code, not left to the model's judgement.

Install

Nothing to install. Every config below runs the published package straight from npm:

npx -y pdf-triage-mcp --root /path/to/your/documents

Your MCP client runs that for you — you only need to paste the config. Confirm it works first:

npx -y pdf-triage-mcp --version

Requires Node 20+. Available on npm as pdf-triage-mcp and in the MCP Registry as io.github.vishalmeena2211/pdf-triage-mcp.

git clone https://github.com/vishalmeena2211/pdf-triage-mcp.gitcd pdf-triage-mcpnpm installnpm run buildnode dist/index.js --root ~/Documents

Connect it to your AI tool

Every config below is complete as written except for one value:

• /Users/me/Documents — replace with the directory the server may read. This is the only thing you must change.

Use an absolute path; ~ is not expanded by most clients. Repeat --root for multiple directories.

PATH gotcha, applies to every GUI client below. Desktop apps launch servers with a minimal environment, so bare npx often fails to resolve even though it works in your terminal. If the server won't start, substitute the absolute path — find it with which npx (commonly /opt/homebrew/bin/npx on Apple Silicon, /usr/local/bin/npx on Intel macOS).

Why -y? It skips npx's install confirmation prompt. Without it, a first run can hang waiting for input that an MCP client cannot provide — the server appears to start and then silently times out.

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

# Just you, this project (default)claude mcp add pdf-triage -- npx -y pdf-triage-mcp --root /Users/me/Documents
# Just you, every projectclaude mcp add --scope user pdf-triage -- npx -y pdf-triage-mcp --root /Users/me/Documents
# Shared with your team, writes .mcp.json to the repoclaude mcp add --scope project pdf-triage -- npx -y pdf-triage-mcp --root /Users/me/Documents

{  "mcpServers": {    "pdf-triage": {      "type": "stdio",      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

{  "servers": {    "pdf-triage": {      "type": "stdio",      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

code --add-mcp '{"name":"pdf-triage","command":"npx","args":["-y","pdf-triage-mcp","--root","/Users/me/Documents"]}'

{  "context_servers": {    "pdf-triage": {      "source": "custom",      "command": {        "path": "npx",        "args": [          "-y", "pdf-triage-mcp",          "--root", "/Users/me/Documents"        ],        "env": {}      }    }  }}

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ],      "disabled": false,      "autoApprove": ["pdf_classify", "pdf_search"]    }  }}

mcpServers:  - name: pdf-triage    command: npx    args:      - -y      - pdf-triage-mcp      - --root      - /Users/me/Documents

gemini mcp add pdf-triage npx -y pdf-triage-mcp --root /Users/me/Documents
# global instead of project-scopedgemini mcp add --scope user pdf-triage npx -y pdf-triage-mcp --root /Users/me/Documents

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ],      "timeout": 30000,      "trust": false    }  }}

[mcp_servers.pdf-triage]command = "npx"args = [  "-y", "pdf-triage-mcp",  "--root", "/Users/me/Documents"]startup_timeout_sec = 20tool_timeout_sec = 60

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

{  "mcpServers": {    "pdf-triage": {      "command": "npx",      "args": [        "-y", "pdf-triage-mcp",        "--root", "/Users/me/Documents"      ]    }  }}

Cheat sheet

The three that differ: VS Code (servers), Zed (context_servers + nested command), Codex (TOML mcp_servers). Everything else takes the Claude Desktop format verbatim.

Tools

Full parameter reference: docs/TOOLS.md.

The intended flow on an unfamiliar document:

pdf_classify → is it text_based with no warnings?  ├─ yes → pdf_search to locate → pdf_extract with `pages`  └─ no  → stop; route to OCR

Configuration

pdf-triage-mcp [options]
  -r, --root <dir>          Directory the server may read. Repeatable. Default: cwd.      --max-chars <n>       Default truncation ceiling. Default: 40000. Max: 200000.      --max-file-bytes <n>  Largest PDF to read. Default: 104857600 (100 MB).      --log-level <level>   debug | info | warn | error | silent. Default: info.  -h, --help                Show usage.  -v, --version             Print version.

Environment equivalents: PDF_TRIAGE_ROOTS (separated by the platform PATH delimiter — : on macOS/Linux, ; on Windows), PDF_TRIAGE_MAX_CHARS, PDF_TRIAGE_MAX_FILE_BYTES, PDF_TRIAGE_LOG_LEVEL. Flags win over environment.

Roots are a security boundary, not a convenience. Grant the narrowest directory that works. Paths are resolved through symlinks before checking, so a link inside a root pointing outside it is rejected rather than followed.

Engine fallback

Upstream ships prebuilt native binaries for exactly three targets: linux-x64-gnu, darwin-arm64, win32-x64-msvc. No musl build, no Linux ARM64 build (upstream #216) — so it fails to load on Alpine containers, Graviton instances, and most edge runtimes.

This server prefers native and falls back to WASM, which runs anywhere. Capability differences are surfaced, never faked:

Check which engine you got: pdf_classify reports it, and the server logs engine selected at startup.

Known limitations

Inherited from upstream. Worth reading before you trust output:

• RTL scripts are broken. Arabic and Hebrew return in visual order, reversed and unusable, while being reported as text_based with high confidence (#212). This server detects and escalates it — the one upstream failure mode we actively guard.
• No xref recovery. Malformed PDFs that pypdf and pdfium silently repair will throw (#228).
• Japanese CIDFontType0 (CFF) subset fonts can decode to unrelated glyphs (#208).
• Multi-column reading order may emit in raster order on some layouts despite columns being detected (#219).
• Images are not PDFs. A scanned JPEG has no text layer; the server rejects non-PDF input rather than pretending otherwise.

Development

npm run typecheck    # tsc --noEmit, maximum strictnessnpm test             # vitest, 108 testsnpm run test:coveragenpm run buildnpm run dev          # tsx, no build step

The TypeScript config runs every strictness flag including exactOptionalPropertyTypes and noUncheckedIndexedAccess. Upstream responses are validated with Zod at the boundary rather than cast — see docs/ARCHITECTURE.md for why.

Debug a client connection:

node dist/index.js --root ~/Documents --log-level debug

Troubleshooting: docs/TROUBLESHOOTING.md.

Roadmap

• pdf_regions — bbox-scoped extraction for hybrid model pipelines
• Positioned-item tool exposing {page, bbox} for visual citation UX
• Integration tests asserting native and WASM produce identical normalized shapes
• Optional OCR adapter interface, closing the routing loop end to end

License

MIT