Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

com.pdfgate/mcp-server

NPM · @PDFGATE/MCP-SERVER · 2 COMPONENTS

MCP server for the PDFGate API. Generate PDFs, manage documents and handle e-signatures.

0 this week 87 Trust /100

Last scanned (21 hours ago)

Scores higher than 91% of npm servers

Category Documents and Files

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 94 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency84
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to pdfgate/pdfgate-mcp-server). View diagnostics → Pass
  • License check failed: no license is declared. See how to fix → Fail
  • Actively maintained (last published 2 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability87
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2905 tokens (~103/item across 28 items; 27 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 99% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_document" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 0
    • Stability: 0.97 → pass security
  • 2 Nov 26 0
    • Stability: pass → 0.97 functional
  • 1 Nov 26 0
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Tool coverage: 100 → unverified ▼ functional
    • Schema quality: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Schema quality: pass → fail ▼ functional
    • Package version: 1.4.0 → 1.5.0 functional
  • 27 Oct 26 0
    • Stability: 0.97 → pass security
  • 26 Oct 26 0
    • Stability: pass → 0.97 functional
  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 16 Oct 26 0
    • Stability: 0.97 → pass security
  • 15 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@pdfgate/mcp-server@1.5.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo pdfgate/pdfgate-mcp-server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/pdfgate/pdfgate-mcp-server/.github/workflows/publish.yml@refs/tags/v1.5.0
Rekor log index 3626603766
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:dac2be37b58a36b76bd315675758b2eb9250a699adce073e5239e7d32db38f2e158f917f0c2ef4549724befa3d1601fa9d3af2293d13a567447541526

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 94 packages
Packages resolved 94
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 27 exposed · ~2,871 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_form_fields ~103

Add interactive form fields to a stored PDF — from placeholder tags (refined via fieldOverrides) and/or explicitly positioned fields.

NameTypeReqDescription
documentIdstringyesThe document ID
fieldOverridesobject–Per-field overrides keyed by field name
fieldsarray–Fields to add at explicit positions
preSignedUrlExpiresIninteger–Generate a fresh pre-signed download URL expiring in this many seconds (60–86400)

No output schema declared.

No examples provided.

compress_pdf ~94

Compress/optimise a PDF to reduce file size without changing visual content.

NameTypeReqDescription
documentIdstringyesThe source document ID to compress
linearizeboolean–Linearise the PDF to enable fast web view (first page renders sooner)
metadataobject–Custom metadata to attach
preSignedUrlExpiresIninteger–Pre-signed download URL expiry in seconds (60–86400)

No output schema declared.

No examples provided.

create_embed_link ~201

Create a short-lived signing URL for an embedded recipient, to be rendered in an iframe inside your application. The envelope must be in 'in_progress' status and the link expires after 10 minutes, so create it when the signer is ready (one link per signing session). On documents with a signingOrder the link can only be created once it is the recipient's turn; the envelope.recipient.activated webhook event signals that moment. When the session ends the iframe redirects to returnUrl with event (signing_complete, voided, expired or not_found), envelopeId, documentId and recipientId appended as query parameters; existing returnUrl query parameters are preserved.

NameTypeReqDescription
documentIdstringyesThe envelope document ID (sourceDocumentId)
envelopeIdstringyesThe envelope ID
recipientIdstringyesThe recipient ID of the embedded recipient
returnUrlstringyesURL the signing session redirects to when it ends

No output schema declared.

No examples provided.

create_envelope ~199

Create a signing envelope from one or more existing PDFGate documents. Each recipient is given either as email and name or as the recipientId of a stored recipient. A recipient signs through the hosted flow (emailed link), embedded signing (embedded: sign inside your application via create_embed_link, no emails) or automatic signing (autoSign: the stored signature of a recipient enrolled with request_recipient_signature is applied on their behalf, no signing session). Use signingOrder to make recipients sign in sequence. Returns an envelope in 'created' status; call send_envelope to dispatch signing emails.

NameTypeReqDescription
documentsarrayyesDocuments to include in the envelope
expiresInDaysinteger–Days until the envelope and its signing links expire, counted from creation. Defaults to the account's envelope expiration setting.
metadataobject–Custom metadata to attach
requesterNamestringyesName of the user or system creating the envelope

No output schema declared.

No examples provided.

create_recipient ~89

Store a recipient in your account so envelopes can reference them by recipientId. Emails are not unique; every call creates a new recipient, so use list_recipients first when reuse is intended.

NameTypeReqDescription
emailstringyesRecipient email address. Stored lowercased and cannot be changed later
metadataobject–Custom metadata to attach
namestring–Recipient display name

No output schema declared.

No examples provided.

create_webhook ~73

Create a PDFGate webhook subscription. The response includes a signing secret — store it securely to verify incoming event signatures.

NameTypeReqDescription
descriptionstring–Optional label to identify this webhook
eventTypesarrayyesEvent types to subscribe to
urlstringyesThe HTTPS endpoint that will receive webhook events

No output schema declared.

No examples provided.

delete_document ~27

Delete a PDFGate document.

NameTypeReqDescription
documentIdstringyesThe document ID to delete

No output schema declared.

No examples provided.

delete_envelope ~87

Permanently delete an envelope and the files it produced (signed documents and audit logs). Recipient data is anonymized and recipients lose access; source documents are not deleted. Only envelopes in 'draft', 'completed', 'expired', or 'voided' status can be deleted — void an active envelope first. Cannot be undone.

NameTypeReqDescription
envelopeIdstringyesThe envelope ID to delete

No output schema declared.

No examples provided.

delete_recipient ~110

Delete a stored recipient from your account directory. The record is kept with its personal data removed (email, name, phone, metadata and any stored signature), so later reads return 404 and a new envelope to the same address creates a fresh recipient; envelopes already sent keep their own copy and are not affected. Rejected with a 400 error while the recipient has an active stored signature or a pending enrolment — call remove_recipient_signature first.

NameTypeReqDescription
recipientIdstringyesThe recipient ID

No output schema declared.

No examples provided.

delete_webhook ~41

Delete a PDFGate webhook subscription. Future events will no longer be delivered to the associated endpoint.

NameTypeReqDescription
webhookIdstringyesThe webhook ID to delete

No output schema declared.

No examples provided.

download_file ~46

Download the raw PDF bytes of a stored document, returned as an embedded resource. For a shareable link instead, use get_document.

NameTypeReqDescription
documentIdstringyesThe document ID

No output schema declared.

No examples provided.

extract_form_data ~46

Extract form field values from a fillable PDF. Returns a JSON object mapping field names to their values.

NameTypeReqDescription
documentIdstringyesThe document ID of the fillable PDF

No output schema declared.

No examples provided.

flatten_pdf ~81

Flatten an interactive PDF into a static, non-editable PDF. Creates a new document; does not overwrite the original.

NameTypeReqDescription
documentIdstringyesThe source document ID to flatten
metadataobject–Custom metadata to attach
preSignedUrlExpiresIninteger–Pre-signed download URL expiry in seconds (60–86400)

No output schema declared.

No examples provided.

generate_pdf ~274

Generate a PDF from a URL or raw HTML. Provide either 'url' or 'html', not both.

NameTypeReqDescription
cssstring–CSS to inject before rendering
emulateMediaTypestring––
enableFormFieldsboolean–Enable interactive PDF form fields from HTML
footerstring–HTML string for the page footer
headerstring–HTML string for the page header
htmlstring–Raw HTML string to render as PDF
javascriptstring–JavaScript to inject before rendering
marginBottomstring–Bottom margin
marginLeftstring–Left margin
marginRightstring–Right margin
marginTopstring–Top margin e.g. '10mm'
metadataobject–Custom metadata to attach
orientationstring–Page orientation (default: portrait)
pageSizeTypestring–Page size (default: a4)
preSignedUrlExpiresIninteger–Pre-signed download URL expiry in seconds (60–86400)
printBackgroundboolean–Print background graphics (default: true)
urlstring–Public URL to render as PDF
waitForNetworkIdleboolean–Wait for network idle before rendering

No output schema declared.

No examples provided.

get_document ~61

Retrieve metadata for a stored PDFGate document by its ID.

NameTypeReqDescription
documentIdstringyesThe document ID
preSignedUrlExpiresIninteger–Generate a fresh pre-signed download URL expiring in this many seconds (60–86400)

No output schema declared.

No examples provided.

get_envelope ~115

Retrieve the current state of an envelope including its status, document progress, and per-recipient signing status. Each recipient carries an embedded boolean; embedded recipients have no signing link — mint one with create_embed_link instead. Recipients on ordered documents carry signingOrder and, once it is their turn, activatedAt. Each recipient also carries autoSign (signed automatically with their stored signature) and sendSignedCopy (emailed the signed document on completion) booleans.

NameTypeReqDescription
envelopeIdstringyesThe envelope ID to retrieve

No output schema declared.

No examples provided.

get_recipient ~91

Retrieve a stored recipient by ID. Once a stored signature was requested the response carries a signature object (status pending, active or revoked, plus requestedAt, adoptionMethod, enrolledAt, revokedAt, lastUsedAt and useCount); while the signature is active it also includes image, the signature as a PNG data URL, which can be very long.

NameTypeReqDescription
recipientIdstringyesThe recipient ID

No output schema declared.

No examples provided.

get_webhook ~30

Retrieve a PDFGate webhook subscription by its ID.

NameTypeReqDescription
webhookIdstringyesThe webhook ID

No output schema declared.

No examples provided.

list_recipients ~36

List stored recipients with the given email (case-insensitive), oldest first.

NameTypeReqDescription
emailstringyesEmail to look up

No output schema declared.

No examples provided.

protect_pdf ~175

Encrypt a PDF with a password and optional permission restrictions. Produces a new document; the original is unchanged.

NameTypeReqDescription
algorithmstring–Encryption algorithm (default: AES256)
disableCopyboolean–Prevent copying text
disableEditingboolean–Prevent editing
disablePrintboolean–Prevent printing
documentIdstringyesThe source document ID to protect
encryptMetadataboolean–Encrypt PDF metadata (default: false)
metadataobject–Custom metadata to attach
ownerPasswordstring–Full-control owner password; required when using AES256 with a userPassword
preSignedUrlExpiresIninteger–Pre-signed download URL expiry in seconds (60–86400)
userPasswordstring–Password required to open the PDF

No output schema declared.

No examples provided.

remove_recipient_signature ~111

Automatic signing: remove the stored signature of a recipient (signature.status becomes 'revoked' and the recipient.signature.revoked webhook fires) or cancel a pending enrolment so its link stops working. Envelopes already waiting on the automatic signature fall back to a signing link emailed to the recipient. Idempotent: a recipient without a stored signature is returned unchanged. Required before delete_recipient while a signature is active or an enrolment is pending.

NameTypeReqDescription
recipientIdstringyesThe recipient ID

No output schema declared.

No examples provided.

request_recipient_signature ~142

Automatic signing: email a stored recipient a link to store a reusable signature (they verify their email with a one-time code, accept the authorization text and type, draw or upload their signature). The link is valid for 7 days and calling this again replaces a pending request with a new link. Returns the recipient with signature.status 'pending'; once they complete the enrolment the recipient.signature.enrolled webhook fires and envelopes can set autoSign on this recipient. Rejected with a 400 error when the recipient has no email or already has an active stored signature (remove it first with remove_recipient_signature).

NameTypeReqDescription
recipientIdstringyesThe recipient ID

No output schema declared.

No examples provided.

send_envelope ~90

Send a created envelope to its recipients. PDFGate dispatches signing emails with secure, OTP-protected links that stay valid until the envelope expires. Embedded recipients receive no email; create their signing links with create_embed_link after sending. On documents with a signingOrder only the first recipients are emailed; later recipients are activated as earlier ones sign.

NameTypeReqDescription
envelopeIdstringyesThe envelope ID to send

No output schema declared.

No examples provided.

update_recipient ~72

Update a stored recipient's name or metadata. The email cannot be changed. Existing envelopes are not affected; they keep the recipient name they were created with.

NameTypeReqDescription
metadataobject–Replacement custom metadata
namestring–New recipient display name
recipientIdstringyesThe recipient ID

No output schema declared.

No examples provided.

upload_file ~105

Upload a PDF to PDFGate so it can be referenced by other operations. Provide either 'filePath' (local path) or 'url'.

NameTypeReqDescription
filePathstring–Absolute local path to the PDF file to upload
metadataobject–Custom metadata to attach
preSignedUrlExpiresIninteger–Pre-signed download URL expiry in seconds (60–86400)
urlstring–Publicly accessible URL of the PDF to upload

No output schema declared.

No examples provided.

void_envelope ~98

Void (cancel) an envelope in 'created' or 'in_progress' status. Recipients who have not signed are notified by email and their signing links stop working; documents already signed by all recipients are not affected. The optional reason is visible to recipients. Cannot be undone.

NameTypeReqDescription
envelopeIdstringyesThe envelope ID to void
reasonstring–Reason for voiding. Included in the cancellation email sent to recipients

No output schema declared.

No examples provided.

watermark_pdf ~274

Apply a text or image watermark to a PDF. For type='text' provide 'text'; for type='image' provide 'watermarkImagePath'.

NameTypeReqDescription
documentIdstringyesThe source document ID
fontstring–Standard PDF font name
fontColorstring–Font colour as hex e.g. '#FF0000'
fontFilePathstring–Local path to a .ttf/.otf font file (overrides 'font')
fontSizenumber–Font size in points
imageHeightnumber–Image watermark height
imageWidthnumber–Image watermark width
metadataobject–Custom metadata to attach
opacitynumber–Opacity 0–1
preSignedUrlExpiresIninteger–Pre-signed download URL expiry in seconds (60–86400)
rotatenumber–Rotation in degrees (0–360)
textstring–Watermark text (required when type='text')
typestringyesWatermark type
watermarkImagePathstring–Local path to a .png/.jpg watermark image (required when type='image')
xPositionnumber–Horizontal position
yPositionnumber–Vertical position

No output schema declared.

No examples provided.

Install

How do I install the com.pdfgate/mcp-server server?

com.pdfgate/mcp-server runs locally as an npm package, launched with npx -y @pdfgate/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @pdfgate/mcp-server

# add to Claude Code
claude mcp add com-pdfgate-mcp-server -- npx -y @pdfgate/mcp-server
Common questions

What is the com.pdfgate/mcp-server server?

com.pdfgate/mcp-server is listed in the public MCP registry as com.pdfgate/mcp-server. MCP server for the PDFGate API. Generate PDFs, manage documents and handle e-signatures. This page covers its npm package (@pdfgate/mcp-server).

Is the com.pdfgate/mcp-server server safe to use?

com.pdfgate/mcp-server scores 87 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the com.pdfgate/mcp-server server expose?

com.pdfgate/mcp-server exposes 27 tools: generate_pdf, upload_file, get_document, delete_document, flatten_pdf, and 22 more. Their descriptions and schemas cost roughly 2,871 tokens of context every time the server is loaded.

Is the com.pdfgate/mcp-server server still maintained?

com.pdfgate/mcp-server is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.