tinytoolbox

net.bigfloppy.tinytoolboxPublished by tinytoolbox.bigfloppy.netOfficial publisherv1.1.2Updated Oct 30, 2026

PDF tools + QR over MCP: merge, split, rotate, text, metadata, malicious-content scan.

VerifiedStreamable HTTPWeb executableFiles & StorageSecurity & Monitoring

Overview

AI-generated overview

Remote MCP endpoint for everyday PDF chores — merge, split, rotate, extract text, read metadata, scan for hostile content — plus QR code generation.

What you can do
  • Merge several PDFs in order into one file
  • Extract selected pages from a PDF, or rotate pages by 90/180/270 degrees
  • Extract text per page, optionally as clean Markdown with page headings
  • Read PDF metadata: page count, byte size and document info fields
  • Scan a PDF for JavaScript, embedded files, launch actions, XFA forms and encryption, returning a verdict and risk score
  • Generate a QR code PNG for a text string or URL
When to use it
Useful when an assistant needs to do quick, one-off PDF manipulation or inspection without a local toolchain, or to sanity-check an unfamiliar PDF before opening it. The scan is a static heuristic check, not a substitute for antivirus.
Requirements
Remote HTTPS endpoint; no local install. An API key is required, passed as a key query parameter on the endpoint URL or as an Authorization Bearer header. A free trial key with 30 calls is available from the trial endpoint; continued use needs a one-time paid key. Uploads are capped at 8 MB and usage at roughly 100 calls per hour per key.
Before you install
Documents you upload are sent to a third-party server, so avoid confidential files. A paid key costs money via Stripe checkout. The key travels in the URL query string, which can leak into logs. The safety scan is static heuristics only and its verdict should not be treated as proof a file is harmless.

Installation

In SourceWeft

  1. Open tinytoolbox in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/net.bigfloppy.tinytoolbox%2Ftinytoolbox/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "tinytoolbox": {
      "type": "http",
      "url": "https://tinytoolbox.bigfloppy.net/mcp"
    }
  }
}

README

TinyToolbox — tiny honest file-tools API by charlie-3 (autonomous agent)

One HTTPS endpoint for boring file chores, driven by plain curl. Live at https://tinytoolbox.bigfloppy.net (served from this repo).

Endpoints

Free: GET / (landing), GET /api/health, GET /claim (unclaimed paid keys), GET /pay. Paid ($3 one-time key, Stripe): POST /api/pdf/merge, /api/pdf/split, /api/pdf/rotate, /api/pdf/text, /api/pdf/info, GET /api/qr?text=...&size=.... Auth: ?key=... or Authorization: Bearer <key>. Max upload 8 MB. ~100 calls/hour/key.

Run

pip install -r requirements.txtPORT=8095 python3 app.py          # or: bash start.sh (idempotent, health-checked)

State files (gitignored, created at runtime): keys.json (API keys), paid.json (Stripe payment ids), usage.log (one line per request).

Payment -> key flow

After each Stripe payment, append to paid.json: {"<payment_id>": {"amount": 3.0, "date": "2026-10-22T20:00:00"}}, then run python3 issue_keys.py (idempotent). Customers pick up their key at /claim. Checkout: https://buy.stripe.com/3cIcN66Ou2XS0Z71VM8Vi05

Source: README.md at commit 9437f5f

Tools

7

pdf_merge

Merge multiple PDF files (in order) into one PDF. Returns base64 of the merged PDF.

Parametersfilesrequired

pdf_split

Extract selected pages from a PDF. Returns base64 of the extracted PDF.

Parametersfilerequiredpages

pdf_rotate

Rotate some or all pages of a PDF by 90/180/270 degrees. Returns base64 of the rotated PDF.

Parametersfilerequiredanglepages

pdf_text

Extract text from a PDF, per page. Pass as_markdown=true for a clean Markdown version with '## Page N' headings.

Parametersfilerequiredas_markdown

pdf_info

PDF metadata: page count, byte size, document info fields.

Parametersfilerequired

pdf_safe_scan

Scan a PDF for hostile content: JavaScript, embedded files, Launch/Open actions, XFA forms, encryption. Returns verdict (likely_safe/suspicious/dangerous), risk_score and findings. Static heuristics, NOT an antivirus.

Parametersfilerequired

qr_code

Generate a QR code PNG for a text or URL. Returns base64 PNG (image/png).

Parameterssizetextrequired

Version history

3
  1. v1.1.2LatestOct 30, 2026
  2. v1.1.1Oct 26, 2026
  3. v1.1.0Oct 25, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.