io.github.bitterdev/pdf-letter-mcp
NPM · PDF-LETTER-MCP · SCANNED AUG 3
Renders letters as print ready PDFs, DIN 5008 compliant for German window envelopes.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security70
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (133 of 137), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 6 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1857 tokens (~265/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 86% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · pdf-letter-mcp
claude mcp add bitterdev-pdf-letter-mcp -- npx -y pdf-letter-mcp
codex mcp add bitterdev-pdf-letter-mcp -- npx -y pdf-letter-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"bitterdev-pdf-letter-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"pdf-letter-mcp"
],
"enabled": true
}
}
} openclaw mcp add bitterdev-pdf-letter-mcp --command npx --arg -y --arg pdf-letter-mcp
mcp_servers:
bitterdev-pdf-letter-mcp:
command: "npx"
args: ["-y", "pdf-letter-mcp"] {
"mcpServers": {
"bitterdev-pdf-letter-mcp": {
"command": "npx",
"args": [
"-y",
"pdf-letter-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +3
- Stability: unverified → 0.23 ▲ functional
- 2 Aug 26 +53
- Known CVEs: unverified → fail ▼ security
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
- 31 Jul 26 −47
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +29
- GHSA-f88m-g3jw-g9cj affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
- 27 Jul 26 23
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes |
Dependencies 133 packages
133 packages in the resolved dependency tree · 130 deprecated · 34 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
create_letter Create letter PDF ~685
Renders a letter as a PDF file in the fixed house layout (DIN 5008 address field, 25 mm writing margin, fold and punch marks, bold subject block). Pass content only, the layout is fixed. The signature image intentionally overlaps the closing line. Returns the absolute file path, the page count, layout metrics and warnings.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Letter text. Blank lines separate paragraphs, "- " starts a bullet list, "1. " a numbered list, **bold** and *italic* are supported, "\pagebreak" forces a page break. |
| closing | string | — | Default is the closing phrase of the locale. |
| copyTo | array | — | — |
| countryDisplay | string | — | When to print the country line, default "auto" (only for foreign recipients). |
| date | string | — | ISO date (2026-07-24), "today" or free text. Default "today". |
| dateStyle | string | — | Default "numeric" (24.07.2026). |
| enclosures | array | — | — |
| locale | string | — | Language of the fixed texts and date format. Supported: de, en, fr, es, it, nl, pt, pl, tr, da, sv, cs. Regional tags such as "en-US" are accepted. Default "de". |
| marks | array | — | Remark zone above the address, max. 3 lines, e.g. ["Einschreiben"]. |
| metadata | object | — | — |
| outputPath | string | — | Target PDF path. Default: PDF_LETTER_OUTPUT_DIR (or the temp directory) plus a name derived from the subject. |
| overwrite | boolean | — | Overwrite an existing file instead of adding a counter, default false. |
| place | string | — | Place for the "place, date" line. |
| profile | string | — | Sender identity, taken from the profile file on this machine (see list_profiles). The profile provides address, return address line and signature image. Use this instead of typing a sender. |
| recipient | object | yes | Recipient, positioned in the DIN 5008 address field so it shows in the envelope window. |
| returnAddressLine | string | — | Return address line above the recipient. Generated from the sender, pass "" to hide it. |
| returnBase64 | boolean | — | Also return the PDF as base64, default false. |
| salutation | string | — | Default is the generic salutation of the locale. |
| sender | object | — | Sender, printed as the small return address line above the recipient. Only needed when no profile is used, a profile always wins. |
| signature | object | — | Signature below the closing line. The image is scaled and placed by the renderer: it is laid over the blank line above the printed name and deliberately overlaps the closing line, exactly like a sign… |
| subject | string | — | Subject line, printed without a "Betreff:" label as required by DIN 5008. |
| subjectLines | array | — | Further bold lines right below the subject. This is where a normal German letter carries references, e.g. ["Zeichen: 535 B 335D028418", "Kunden-Nummer: 335D028418"]. |
No output schema declared.
No examples provided.
get_din5008_spec Get DIN 5008 geometry ~39
Returns the millimetre geometry of the layout: address field, remark zone, writing margins, subject position, fold and punch marks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_fonts List fonts ~51
Lists the built-in font families and resolves a font name against the installed system fonts, so you can check what create_letter would embed.
| Name | Type | Req | Description |
|---|---|---|---|
| family | string | — | Font family or .ttf path to resolve. |
No output schema declared.
No examples provided.
list_locales List locales ~44
Lists the supported languages together with their fixed texts (salutation, closing, enclosures, page numbering).
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | — | Return the labels of a single locale. |
No output schema declared.
No examples provided.
list_profiles List sender profiles ~38
Lists the sender profiles configured on this machine. Each profile carries the address and the signature of one person, so create_letter only needs the profile key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
prepare_signature Prepare signature image ~195
Cleans up a scanned signature: crops white borders, turns the paper background transparent and optionally recolours the ink. Writes a PNG that can be passed to create_letter as signature.path. Needs the optional sharp dependency.
| Name | Type | Req | Description |
|---|---|---|---|
| backgroundThreshold | number | — | Luminance cutoff, default 0.85. |
| base64 | string | — | Image data as base64 or data URL, alternative to path. |
| inkColor | string | — | Recolour the ink, e.g. "#1a1a1a". |
| outputPath | string | — | Target PNG path. Default: output directory plus "signature.png". |
| overwrite | boolean | — | — |
| path | string | — | Path to the scan (PNG, JPEG, and with sharp also WebP/TIFF/HEIC). |
| removeBackground | boolean | — | Turn the white background transparent, default true. |
| trim | boolean | — | Crop uniform borders, default true. |
No output schema declared.
No examples provided.
preview_letter Preview letter layout ~581
Renders the letter in memory and returns layout metrics and warnings without writing a file. Use it to check whether the address fits the address field or the letter runs onto a second page.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Letter text. Blank lines separate paragraphs, "- " starts a bullet list, "1. " a numbered list, **bold** and *italic* are supported, "\pagebreak" forces a page break. |
| closing | string | — | Default is the closing phrase of the locale. |
| copyTo | array | — | — |
| countryDisplay | string | — | When to print the country line, default "auto" (only for foreign recipients). |
| date | string | — | ISO date (2026-07-24), "today" or free text. Default "today". |
| dateStyle | string | — | Default "numeric" (24.07.2026). |
| enclosures | array | — | — |
| locale | string | — | Language of the fixed texts and date format. Supported: de, en, fr, es, it, nl, pt, pl, tr, da, sv, cs. Regional tags such as "en-US" are accepted. Default "de". |
| marks | array | — | Remark zone above the address, max. 3 lines, e.g. ["Einschreiben"]. |
| metadata | object | — | — |
| place | string | — | Place for the "place, date" line. |
| profile | string | — | Sender identity, taken from the profile file on this machine (see list_profiles). The profile provides address, return address line and signature image. Use this instead of typing a sender. |
| recipient | object | yes | Recipient, positioned in the DIN 5008 address field so it shows in the envelope window. |
| returnAddressLine | string | — | Return address line above the recipient. Generated from the sender, pass "" to hide it. |
| salutation | string | — | Default is the generic salutation of the locale. |
| sender | object | — | Sender, printed as the small return address line above the recipient. Only needed when no profile is used, a profile always wins. |
| signature | object | — | Signature below the closing line. The image is scaled and placed by the renderer: it is laid over the blank line above the printed name and deliberately overlaps the closing line, exactly like a sign… |
| subject | string | — | Subject line, printed without a "Betreff:" label as required by DIN 5008. |
| subjectLines | array | — | Further bold lines right below the subject. This is where a normal German letter carries references, e.g. ["Zeichen: 535 B 335D028418", "Kunden-Nummer: 335D028418"]. |
No output schema declared.
No examples provided.