io.github.bitterdev/pdf-letter-mcp
NPM · PDF-LETTER-MCP · SCANNED SEP 21
Renders letters as print ready PDFs, DIN 5008 compliant for German window envelopes.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 36 of 134 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 55 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1857 tokens (~265/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 86% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.bitterdev/pdf-letter-mcp server?
io.github.bitterdev/pdf-letter-mcp runs locally as an npm package, launched with npx -y pdf-letter-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · pdf-letter-mcp
claude mcp add bitterdev-pdf-letter-mcp -- npx -y pdf-letter-mcp
{
"mcpServers": {
"bitterdev-pdf-letter-mcp": {
"command": "npx",
"args": [
"-y",
"pdf-letter-mcp"
]
}
}
} {
"servers": {
"bitterdev-pdf-letter-mcp": {
"command": "npx",
"args": [
"-y",
"pdf-letter-mcp"
]
}
}
} codex mcp add bitterdev-pdf-letter-mcp -- npx -y pdf-letter-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"bitterdev-pdf-letter-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"pdf-letter-mcp"
],
"enabled": true
}
}
} openclaw mcp add bitterdev-pdf-letter-mcp --command npx --arg -y --arg pdf-letter-mcp
mcp_servers:
bitterdev-pdf-letter-mcp:
command: "npx"
args: ["-y", "pdf-letter-mcp"] {
"McpServers": {
"bitterdev-pdf-letter-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"pdf-letter-mcp"
]
}
}
} assistant mcp add bitterdev-pdf-letter-mcp -t stdio -c npx -a -y pdf-letter-mcp
{
"mcpServers": {
"bitterdev-pdf-letter-mcp": {
"command": "npx",
"args": [
"-y",
"pdf-letter-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 0
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.77 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/pdf-letter-mcp@1.0.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes | ||
| GHSA-rgj7-g3m4-5g8c | high | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 134 packages
| Packages resolved | 134 |
|---|---|
| Stale | 36 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_letter Create letter PDF ~685
Renders a letter as a PDF file in the fixed house layout (DIN 5008 address field, 25 mm writing margin, fold and punch marks, bold subject block). Pass content only, the layout is fixed. The signature image intentionally overlaps the closing line. Returns the absolute file path, the page count, layout metrics and warnings.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Letter text. Blank lines separate paragraphs, "- " starts a bullet list, "1. " a numbered list, **bold** and *italic* are supported, "\pagebreak" forces a page break. |
| closing | string | – | Default is the closing phrase of the locale. |
| copyTo | array | – | – |
| countryDisplay | string | – | When to print the country line, default "auto" (only for foreign recipients). |
| date | string | – | ISO date (2026-07-24), "today" or free text. Default "today". |
| dateStyle | string | – | Default "numeric" (24.07.2026). |
| enclosures | array | – | – |
| locale | string | – | Language of the fixed texts and date format. Supported: de, en, fr, es, it, nl, pt, pl, tr, da, sv, cs. Regional tags such as "en-US" are accepted. Default "de". |
| marks | array | – | Remark zone above the address, max. 3 lines, e.g. ["Einschreiben"]. |
| metadata | object | – | – |
| outputPath | string | – | Target PDF path. Default: PDF_LETTER_OUTPUT_DIR (or the temp directory) plus a name derived from the subject. |
| overwrite | boolean | – | Overwrite an existing file instead of adding a counter, default false. |
| place | string | – | Place for the "place, date" line. |
| profile | string | – | Sender identity, taken from the profile file on this machine (see list_profiles). The profile provides address, return address line and signature image. Use this instead of typing a sender. |
| recipient | object | yes | Recipient, positioned in the DIN 5008 address field so it shows in the envelope window. |
| returnAddressLine | string | – | Return address line above the recipient. Generated from the sender, pass "" to hide it. |
| returnBase64 | boolean | – | Also return the PDF as base64, default false. |
| salutation | string | – | Default is the generic salutation of the locale. |
| sender | object | – | Sender, printed as the small return address line above the recipient. Only needed when no profile is used, a profile always wins. |
| signature | object | – | Signature below the closing line. The image is scaled and placed by the renderer: it is laid over the blank line above the printed name and deliberately overlaps the closing line, exactly like a sign… |
| subject | string | – | Subject line, printed without a "Betreff:" label as required by DIN 5008. |
| subjectLines | array | – | Further bold lines right below the subject. This is where a normal German letter carries references, e.g. ["Zeichen: 535 B 335D028418", "Kunden-Nummer: 335D028418"]. |
No output schema declared.
No examples provided.
get_din5008_spec Get DIN 5008 geometry ~39
Returns the millimetre geometry of the layout: address field, remark zone, writing margins, subject position, fold and punch marks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_fonts List fonts ~51
Lists the built-in font families and resolves a font name against the installed system fonts, so you can check what create_letter would embed.
| Name | Type | Req | Description |
|---|---|---|---|
| family | string | – | Font family or .ttf path to resolve. |
No output schema declared.
No examples provided.
list_locales List locales ~44
Lists the supported languages together with their fixed texts (salutation, closing, enclosures, page numbering).
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Return the labels of a single locale. |
No output schema declared.
No examples provided.
list_profiles List sender profiles ~38
Lists the sender profiles configured on this machine. Each profile carries the address and the signature of one person, so create_letter only needs the profile key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
prepare_signature Prepare signature image ~195
Cleans up a scanned signature: crops white borders, turns the paper background transparent and optionally recolours the ink. Writes a PNG that can be passed to create_letter as signature.path. Needs the optional sharp dependency.
| Name | Type | Req | Description |
|---|---|---|---|
| backgroundThreshold | number | – | Luminance cutoff, default 0.85. |
| base64 | string | – | Image data as base64 or data URL, alternative to path. |
| inkColor | string | – | Recolour the ink, e.g. "#1a1a1a". |
| outputPath | string | – | Target PNG path. Default: output directory plus "signature.png". |
| overwrite | boolean | – | – |
| path | string | – | Path to the scan (PNG, JPEG, and with sharp also WebP/TIFF/HEIC). |
| removeBackground | boolean | – | Turn the white background transparent, default true. |
| trim | boolean | – | Crop uniform borders, default true. |
No output schema declared.
No examples provided.
preview_letter Preview letter layout ~581
Renders the letter in memory and returns layout metrics and warnings without writing a file. Use it to check whether the address fits the address field or the letter runs onto a second page.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Letter text. Blank lines separate paragraphs, "- " starts a bullet list, "1. " a numbered list, **bold** and *italic* are supported, "\pagebreak" forces a page break. |
| closing | string | – | Default is the closing phrase of the locale. |
| copyTo | array | – | – |
| countryDisplay | string | – | When to print the country line, default "auto" (only for foreign recipients). |
| date | string | – | ISO date (2026-07-24), "today" or free text. Default "today". |
| dateStyle | string | – | Default "numeric" (24.07.2026). |
| enclosures | array | – | – |
| locale | string | – | Language of the fixed texts and date format. Supported: de, en, fr, es, it, nl, pt, pl, tr, da, sv, cs. Regional tags such as "en-US" are accepted. Default "de". |
| marks | array | – | Remark zone above the address, max. 3 lines, e.g. ["Einschreiben"]. |
| metadata | object | – | – |
| place | string | – | Place for the "place, date" line. |
| profile | string | – | Sender identity, taken from the profile file on this machine (see list_profiles). The profile provides address, return address line and signature image. Use this instead of typing a sender. |
| recipient | object | yes | Recipient, positioned in the DIN 5008 address field so it shows in the envelope window. |
| returnAddressLine | string | – | Return address line above the recipient. Generated from the sender, pass "" to hide it. |
| salutation | string | – | Default is the generic salutation of the locale. |
| sender | object | – | Sender, printed as the small return address line above the recipient. Only needed when no profile is used, a profile always wins. |
| signature | object | – | Signature below the closing line. The image is scaled and placed by the renderer: it is laid over the blank line above the printed name and deliberately overlaps the closing line, exactly like a sign… |
| subject | string | – | Subject line, printed without a "Betreff:" label as required by DIN 5008. |
| subjectLines | array | – | Further bold lines right below the subject. This is where a normal German letter carries references, e.g. ["Zeichen: 535 B 335D028418", "Kunden-Nummer: 335D028418"]. |
No output schema declared.
No examples provided.
What is the io.github.bitterdev/pdf-letter-mcp server?
io.github.bitterdev/pdf-letter-mcp is listed in the public MCP registry as io.github.bitterdev/pdf-letter-mcp. Renders letters as print ready PDFs, DIN 5008 compliant for German window envelopes. This page covers its npm package (pdf-letter-mcp).
Is the io.github.bitterdev/pdf-letter-mcp server safe to use?
io.github.bitterdev/pdf-letter-mcp scores 75 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.bitterdev/pdf-letter-mcp server expose?
io.github.bitterdev/pdf-letter-mcp exposes 7 tools: create_letter, preview_letter, prepare_signature, list_profiles, get_din5008_spec, and 2 more. Their descriptions and schemas cost roughly 1,633 tokens of context every time the server is loaded.
Is the io.github.bitterdev/pdf-letter-mcp server still maintained?
io.github.bitterdev/pdf-letter-mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.bitterdev/pdf-letter-mcp server under?
io.github.bitterdev/pdf-letter-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.