io.github.benbergner/benspdf
PYPI · BENSPDF-MCP
Read PDFs locally: text, pages, metadata, scan detection, layout, permissions, render, OCR.
Available components
Last scanned (14 hours ago)
Scores higher than 93% of PyPI servers
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 31 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to benbergner/BensPDF). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 52 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2674 tokens (~222/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (92% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "discard" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Security disclosure: unverified → fail ▼ functional
- 3 Nov 26 +1
- Stability: 0.97 → pass security
- 2 Nov 26 −1
- Security disclosure: fail → unverified ▼ functional
- Stability: pass → 0.97 functional
- 31 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 30 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- 19 Oct 26 −1
- Stability: pass → 0.93 functional
- 17 Oct 26 +3
- Stability: 0.83 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/benspdf-mcp@0.3.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | benbergner/BensPDF |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/benbergner/BensPDF/.github/workflows/release.yml@refs/tags/v0.3.0 |
| Rekor log index | 2821184929 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:f66e8838afd842f19b2f3ba16eb3468b70baadb99f2f97087396eedcebe61391 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | Known build tool | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 31 packages
| Packages resolved | 31 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_test_pdf_file ~119
Create a test PDF, handy for trying the other tools without hunting for one. The pages are blank, so this is for exercising tools rather than for anything that needs real content. Args: output_path: Optional path to also write the PDF to. Omit to keep it as a temporary artifact. num_pages: Number of blank pages to create (default: 3) title: Optional title for the PDF metadata
| Name | Type | Req | Description |
|---|---|---|---|
| num_pages | integer | – | – |
| output_path | – | – | – |
| title | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
discard ~79
Delete temporary artifacts from the workspace now. Only accepts artifact ids, never file paths, so this cannot delete the user's own files. Artifacts expire on their own, so this is only needed when the user explicitly asks to clean up. Args: refs: Artifact id, or list of artifact ids, to delete.
| Name | Type | Req | Description |
|---|---|---|---|
| refs | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
export ~243
Save one or more results to a real location on disk. The only tool that writes to the user's filesystem, so call it once at the end, when they have said where the output should go. Never hand an artifact id back as if it were a finished file; artifacts expire. Args: refs: Artifact id, or list of artifact ids, to export. dest: Where to write. For a single artifact this may be a full file path. For several artifacts, or when `name` is given, this is a directory and is created if missing. name: Filename template used when writing into a directory. Placeholders: {n} 1-based index (e.g. "page_{n:03d}{ext}"), {ext} extension, {id} artifact id, {stem} id without extension. Defaults to "{n:03d}{ext}". overwrite: Replace existing files instead of failing. Defaults to False so nothing is destroyed by accident.
| Name | Type | Req | Description |
|---|---|---|---|
| dest | string | yes | – |
| name | – | – | – |
| overwrite | boolean | – | – |
| refs | – | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
list_artifacts ~69
List recent temporary artifacts in the workspace, newest first. Useful when you have lost track of an artifact id from earlier in the conversation, so you can find it again instead of redoing the work. Args: limit: Maximum number of artifacts to return.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_check_access ~230
Check a PDF's encryption and what it permits: printing, copying, editing. Answers "is this locked, and what am I allowed to do with it?". `encrypted` and `needs_password` are separate answers and the difference matters: most encrypted files have no user password, so they open silently and only carry restrictions. `permissions` gives a boolean per action, `restrictions` lists what is denied, and an unencrypted file permits everything — a PDF has nowhere to keep restrictions but its encryption dictionary. Treat restrictions as what the file asks of viewers, not as enforcement: once a document is open nothing stops the bits being ignored, and a file that denies copying still yields its text to pdf_extract_text. Report them as the author's intent, never as an action being impossible. Worth reaching for when another tool reports a file as encrypted; this one still answers, since the encryption dictionary is readable when the pages are not. Args: ref: PDF file path, or a workspace artifact id.
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_check_text ~229
Check whether a PDF has a text layer, looks scanned, or needs OCR. Answers "can I read this, or is it a picture of a document?". Worth running before extracting text from a file you have not seen. `verdict` is "text", "scanned", "mixed", or "no_text" — the last meaning nothing readable but nothing scan-like either, so blank, vector-only, or illustrated pages that OCR cannot help. `needs_ocr` follows from it, `summary` is a sentence worth quoting, and the per page evidence behind the verdict comes back alongside, including each page's `image_coverage` (the largest image's share of the page area). Samples up to 10 pages spread across the document, so a true `sampled` means the answer is an estimate for the pages in between. It does not return the text (use pdf_extract_text) and it does not run OCR. Args: ref: PDF file path, or a workspace artifact id.
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_extract_text ~327
Read the text of a PDF that has one, page by page. The cheap and exact way to read a document: milliseconds a page, and the characters are the ones the file holds. Prefer it to pdf_ocr, which is for pages carrying no text, and to pdf_render_pages, which costs an image a page. pdf_check_text says which path a file needs; page numbers come back with the text, so quote page 8 rather than "the document". A long document arrives in ranges: one call returns about 50,000 characters and names the pages it did not reach, so when `truncated`, do what the summary says. `output="txt"` writes the whole extraction to an artifact and returns the counts alone, which is the way to read a book. Text on a `text_suspect` page came back partly undecodable, because the fonts carry no character map: say so rather than quoting it, and look at the page with pdf_render_pages. Args: ref: PDF file path, or a workspace artifact id. pages: Which pages: "1-10", "3", "1,5,9-12" or "all". Defaults to all. output: "text", "txt" for the text as an artifact, or "both". layout: Keep the page's spacing, for forms and tables. Costs characters.
| Name | Type | Req | Description |
|---|---|---|---|
| layout | boolean | – | – |
| output | string | – | – |
| pages | – | – | – |
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_metadata ~194
Read a PDF's document properties: title, author, dates, producer, keywords. Answers "who made this, when, and with what". It does not count pages (use pdf_page_count) and says nothing about whether the pages hold readable text (use pdf_check_text). A PDF can store these fields in two independent places, the legacy Info dictionary and an XMP packet, and the two often disagree. The normalized answer is at the top level, preferring XMP, with `sources` naming the store each value came from and `conflicts` listing every field where the two differ, both values included. Both stores also come back verbatim as `info` and `xmp`. When `has_conflicts` is true, say so rather than quoting one value as fact. Args: ref: PDF file path, or a workspace artifact id.
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_ocr ~329
Read a scanned PDF with OCR, and optionally add a real text layer to it. The way to read a page with no text: a scan, or an export that lost its text. Prefer it to pdf_render_pages for reading; run pdf_check_text when unsure. Tesseract is a system install, and a missing binary or language errors with how to install it. OCR can be confidently wrong, so pages report `mean_confidence` and `low_confidence_words`: say when confidence is low rather than presenting text as certain, and look at a bad page with pdf_render_pages. Text pages are skipped unless `force`. A long document may stop early; when `truncated`, do exactly what the summary says, artifact and range included. Args: ref: PDF file path, or a workspace artifact id. pages: Which pages: "1-10", "3", "1,5,9-12" or "all". Defaults to all. lang: Tesseract language code, or several as "eng+deu". dpi: Resolution, 72 to 600. 200 suits printed text; higher is slower, not better. output: "text", "pdf" for a searchable copy as an artifact, or "both". force: OCR pages that already have text instead of skipping them.
| Name | Type | Req | Description |
|---|---|---|---|
| dpi | integer | – | – |
| force | boolean | – | – |
| lang | string | – | – |
| output | string | – | – |
| pages | – | – | – |
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_page_count ~78
Count the pages in a PDF. Answers "how many pages is this?". Reads only the document's page tree, so it stays cheap on large files. It does not read page text, page sizes, or document properties. Args: ref: PDF file path, or a workspace artifact id.
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_page_layout ~275
Measure a PDF's page sizes, orientation and rotation. Answers "what size is this, is it all the same, and why does one page come out sideways?". Reads page geometry only, so it stays cheap on long documents. `sizes` groups the pages by shape, most pages first, each carrying the page numbers it covers as a range like "1-16,18", so a 300 page document answers in one entry instead of 300 rows. Sizes are the page as a reader sees it: CropBox clipped to MediaBox with `/Rotate` applied, so a landscape box rotated 90 degrees reports as portrait. Pages within 3pt of a known paper are grouped and named together, since real A4 varies by a millimetre. Pass `pages` for per page rows carrying the raw boxes: "1-20", "3", "1,5,9-12" or "all", capped at 100 rows. It does not look at page content; for whether the pages hold readable text use pdf_check_text. Args: ref: PDF file path, or a workspace artifact id. pages: Optional page range for per page detail. Omit for groups only.
| Name | Type | Req | Description |
|---|---|---|---|
| pages | – | – | – |
| ref | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
pdf_render_pages ~299
Render PDF pages to images, so a page can be looked at rather than read. Use it to see what a page looks like: checking a change landed (did a redaction remove content, did a split cut where intended), previewing, and pages where appearance is the content — handwriting, signatures, charts, checkbox state. For *reading* a scan prefer pdf_ocr, whose text layer is searchable and needs no vision model; render when OCR is unavailable or would mangle what matters. Every page is saved as a PNG artifact and its id returned. With `view`, the default, the first few images also come back to be looked at, since images are expensive in context. Limits are explicit: 20 pages per call, and resolution is reduced for a page that would be enormous — both reported, never silent. Args: ref: PDF file path, or a workspace artifact id. pages: Which pages: "1-20", "3", "1,5,9-12" or "all". Defaults to all, up to the per-call limit. dpi: Resolution, 36 to 600. 150 suits reading and previewing. view: Return the images to look at, not just artifact ids.
| Name | Type | Req | Description |
|---|---|---|---|
| dpi | integer | – | – |
| pages | – | – | – |
| ref | string | yes | – |
| view | boolean | – | – |
No output schema declared.
No examples provided.
How do I install the io.github.benbergner/benspdf MCP server?
io.github.benbergner/benspdf runs locally as a PyPI package, launched with uvx benspdf-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · benspdf-mcp
claude mcp add benbergner-benspdf -- uvx benspdf-mcp
What is the io.github.benbergner/benspdf MCP server?
io.github.benbergner/benspdf is an MCP server listed in the public MCP registry as io.github.benbergner/benspdf. Read PDFs locally: text, pages, metadata, scan detection, layout, permissions, render, OCR. This page covers its PyPI package (benspdf-mcp).
Is the io.github.benbergner/benspdf MCP server safe to use?
io.github.benbergner/benspdf scores 90 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.benbergner/benspdf MCP server expose?
io.github.benbergner/benspdf exposes 12 tools: export, list_artifacts, discard, pdf_page_count, pdf_metadata, and 7 more. Their descriptions and schemas cost roughly 2,471 tokens of context every time the server is loaded.
Is the io.github.benbergner/benspdf MCP server still maintained?
io.github.benbergner/benspdf is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.benbergner/benspdf MCP server under?
io.github.benbergner/benspdf declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the io.github.benbergner/benspdf MCP server?
VerifyMCP ran 16 checks on io.github.benbergner/benspdf, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.