# io.github.bitterdev/pdf-letter-mcp (npm · pdf-letter-mcp)

Renders letters as print ready PDFs, DIN 5008 compliant for German window envelopes.

- Trust score: 61/100 (medium)
- Change this week: +38
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `pdf-letter-mcp`: 61/100 (this document), [markdown](https://verifymcp.io/servers/bitterdev-pdf-letter-mcp/pdf-letter-mcp.md), [page](https://verifymcp.io/servers/bitterdev-pdf-letter-mcp/pdf-letter-mcp)

## Channel facts

- Registry: `npm`
- Package: `pdf-letter-mcp`
- Version: `1.0.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 70/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (133 of 137), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 6 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1857 tokens (~265/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 86% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add bitterdev-pdf-letter-mcp -- npx -y pdf-letter-mcp
```

### Codex

```bash
codex mcp add bitterdev-pdf-letter-mcp -- npx -y pdf-letter-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bitterdev-pdf-letter-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "pdf-letter-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add bitterdev-pdf-letter-mcp --command npx --arg -y --arg pdf-letter-mcp
```

### Hermes

```yaml
mcp_servers:
  bitterdev-pdf-letter-mcp:
    command: "npx"
    args: ["-y", "pdf-letter-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "bitterdev-pdf-letter-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "pdf-letter-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 61, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 58, +53)

- [security regression] Known CVEs: unverified → fail
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 5, −47)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 52, +29)

- [security regression] GHSA-f88m-g3jw-g9cj affects this package: high
- [security regression] Known CVEs: unverified → fail
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-27 (score 23)

First indexed and scored.

## MCP tools (7)

### `create_letter` (~685 tokens)

Create letter PDF

Renders a letter as a PDF file in the fixed house layout (DIN 5008 address field, 25 mm writing margin, fold and punch marks, bold subject block). Pass content only, the layout is fixed. The signature image intentionally overlaps the closing line. Returns the absolute file path, the page count, layout metrics and warnings.

Input parameters:

- `body` (string, required): Letter text. Blank lines separate paragraphs, "- " starts a bullet list, "1. " a numbered list, **bold** and *italic* are supported, "\pagebreak" forces a page break.
- `closing` (string): Default is the closing phrase of the locale.
- `copyTo` (array)
- `countryDisplay` (string): When to print the country line, default "auto" (only for foreign recipients).
- `date` (string): ISO date (2026-07-24), "today" or free text. Default "today".
- `dateStyle` (string): Default "numeric" (24.07.2026).
- `enclosures` (array)
- `locale` (string): Language of the fixed texts and date format. Supported: de, en, fr, es, it, nl, pt, pl, tr, da, sv, cs. Regional tags such as "en-US" are accepted. Default "de".
- `marks` (array): Remark zone above the address, max. 3 lines, e.g. ["Einschreiben"].
- `metadata` (object)
- `outputPath` (string): Target PDF path. Default: PDF_LETTER_OUTPUT_DIR (or the temp directory) plus a name derived from the subject.
- `overwrite` (boolean): Overwrite an existing file instead of adding a counter, default false.
- `place` (string): Place for the "place, date" line.
- `profile` (string): Sender identity, taken from the profile file on this machine (see list_profiles). The profile provides address, return address line and signature image. Use this instead of typing a sender.
- `recipient` (object, required): Recipient, positioned in the DIN 5008 address field so it shows in the envelope window.
- `returnAddressLine` (string): Return address line above the recipient. Generated from the sender, pass "" to hide it.
- `returnBase64` (boolean): Also return the PDF as base64, default false.
- `salutation` (string): Default is the generic salutation of the locale.
- `sender` (object): Sender, printed as the small return address line above the recipient. Only needed when no profile is used, a profile always wins.
- `signature` (object): Signature below the closing line. The image is scaled and placed by the renderer: it is laid over the blank line above the printed name and deliberately overlaps the closing line, exactly like a sign…
- `subject` (string): Subject line, printed without a "Betreff:" label as required by DIN 5008.
- `subjectLines` (array): Further bold lines right below the subject. This is where a normal German letter carries references, e.g. ["Zeichen: 535 B 335D028418", "Kunden-Nummer: 335D028418"].

### `preview_letter` (~581 tokens)

Preview letter layout

Renders the letter in memory and returns layout metrics and warnings without writing a file. Use it to check whether the address fits the address field or the letter runs onto a second page.

Input parameters:

- `body` (string, required): Letter text. Blank lines separate paragraphs, "- " starts a bullet list, "1. " a numbered list, **bold** and *italic* are supported, "\pagebreak" forces a page break.
- `closing` (string): Default is the closing phrase of the locale.
- `copyTo` (array)
- `countryDisplay` (string): When to print the country line, default "auto" (only for foreign recipients).
- `date` (string): ISO date (2026-07-24), "today" or free text. Default "today".
- `dateStyle` (string): Default "numeric" (24.07.2026).
- `enclosures` (array)
- `locale` (string): Language of the fixed texts and date format. Supported: de, en, fr, es, it, nl, pt, pl, tr, da, sv, cs. Regional tags such as "en-US" are accepted. Default "de".
- `marks` (array): Remark zone above the address, max. 3 lines, e.g. ["Einschreiben"].
- `metadata` (object)
- `place` (string): Place for the "place, date" line.
- `profile` (string): Sender identity, taken from the profile file on this machine (see list_profiles). The profile provides address, return address line and signature image. Use this instead of typing a sender.
- `recipient` (object, required): Recipient, positioned in the DIN 5008 address field so it shows in the envelope window.
- `returnAddressLine` (string): Return address line above the recipient. Generated from the sender, pass "" to hide it.
- `salutation` (string): Default is the generic salutation of the locale.
- `sender` (object): Sender, printed as the small return address line above the recipient. Only needed when no profile is used, a profile always wins.
- `signature` (object): Signature below the closing line. The image is scaled and placed by the renderer: it is laid over the blank line above the printed name and deliberately overlaps the closing line, exactly like a sign…
- `subject` (string): Subject line, printed without a "Betreff:" label as required by DIN 5008.
- `subjectLines` (array): Further bold lines right below the subject. This is where a normal German letter carries references, e.g. ["Zeichen: 535 B 335D028418", "Kunden-Nummer: 335D028418"].

### `prepare_signature` (~195 tokens)

Prepare signature image

Cleans up a scanned signature: crops white borders, turns the paper background transparent and optionally recolours the ink. Writes a PNG that can be passed to create_letter as signature.path. Needs the optional sharp dependency.

Input parameters:

- `backgroundThreshold` (number): Luminance cutoff, default 0.85.
- `base64` (string): Image data as base64 or data URL, alternative to path.
- `inkColor` (string): Recolour the ink, e.g. "#1a1a1a".
- `outputPath` (string): Target PNG path. Default: output directory plus "signature.png".
- `overwrite` (boolean)
- `path` (string): Path to the scan (PNG, JPEG, and with sharp also WebP/TIFF/HEIC).
- `removeBackground` (boolean): Turn the white background transparent, default true.
- `trim` (boolean): Crop uniform borders, default true.

### `list_profiles` (~38 tokens)

List sender profiles

Lists the sender profiles configured on this machine. Each profile carries the address and the signature of one person, so create_letter only needs the profile key.

### `get_din5008_spec` (~39 tokens)

Get DIN 5008 geometry

Returns the millimetre geometry of the layout: address field, remark zone, writing margins, subject position, fold and punch marks.

### `list_locales` (~44 tokens)

List locales

Lists the supported languages together with their fixed texts (salutation, closing, enclosures, page numbering).

Input parameters:

- `locale` (string): Return the labels of a single locale.

### `list_fonts` (~51 tokens)

List fonts

Lists the built-in font families and resolves a font name against the installed system fonts, so you can check what create_letter would embed.

Input parameters:

- `family` (string): Font family or .ttf path to resolve.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/bitterdev-pdf-letter-mcp/pdf-letter-mcp#diagnostics

## Score history

- 2026-08-03: 61
- 2026-08-02: 58
- 2026-08-01: 5
- 2026-07-31: 5
- 2026-07-30: 52
- 2026-07-29: 52
- 2026-07-27: 23

## Links

- npm package: https://www.npmjs.com/package/pdf-letter-mcp
- Socket report: https://socket.dev/npm/package/pdf-letter-mcp
- Repository: https://github.com/bitterdev/pdf-letter-mcp
- Changelog RSS feed: https://verifymcp.io/servers/bitterdev-pdf-letter-mcp/pdf-letter-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/bitterdev-pdf-letter-mcp/pdf-letter-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/bitterdev-pdf-letter-mcp/pdf-letter-mcp