com.pdfgate/mcp-server
NPM · @PDFGATE/MCP-SERVER · 2 COMPONENTS · SCANNED SEP 20
MCP server for the PDFGate API. Generate PDFs, manage documents and handle e-signatures.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 97 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency84
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to pdfgate/pdfgate-mcp-server). View diagnostics → Pass
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability87
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2406 tokens (~96/item across 25 items; 24 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_document" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the com.pdfgate/mcp-server server?
com.pdfgate/mcp-server runs locally as an npm package, launched with npx -y @pdfgate/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @pdfgate/mcp-server
claude mcp add com-pdfgate-mcp-server -- npx -y @pdfgate/mcp-server
{
"mcpServers": {
"com-pdfgate-mcp-server": {
"command": "npx",
"args": [
"-y",
"@pdfgate/mcp-server"
]
}
}
} {
"servers": {
"com-pdfgate-mcp-server": {
"command": "npx",
"args": [
"-y",
"@pdfgate/mcp-server"
]
}
}
} codex mcp add com-pdfgate-mcp-server -- npx -y @pdfgate/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-pdfgate-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@pdfgate/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add com-pdfgate-mcp-server --command npx --arg -y --arg @pdfgate/mcp-server
mcp_servers:
com-pdfgate-mcp-server:
command: "npx"
args: ["-y", "@pdfgate/mcp-server"] {
"McpServers": {
"com-pdfgate-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@pdfgate/mcp-server"
]
}
}
} assistant mcp add com-pdfgate-mcp-server -t stdio -c npx -a -y @pdfgate/mcp-server
{
"mcpServers": {
"com-pdfgate-mcp-server": {
"command": "npx",
"args": [
"-y",
"@pdfgate/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Stability: 0.87 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 1.3.0 → 1.4.0 functional
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −2
- Stability: pass → 0.80 functional
- 16 Sept 26 +2
- Stability: fail → pass ▲ security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 79 to 82.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 72 to 76.
- 9 Sept 26 −2
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 1855 → 2323 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 1.2.0 → 1.3.0 functional
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 79 to 82.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@pdfgate/mcp-server@1.4.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | pdfgate/pdfgate-mcp-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/pdfgate/pdfgate-mcp-server/.github/workflows/publish.yml@refs/tags/v1.4.0 |
| Rekor log index | 2898820916 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:93a504d494a317cc7d7435412e6aa52c7ea0314ab94402a227b5ad433d1f431f9e0373d5d2f05c764a2c98b7f721f45bdc12646f33e288f0133806bf0 |
Background: How many MCP packages publish verified provenance →
Dependencies 97 packages
| Packages resolved | 97 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_form_fields ~103
Add interactive form fields to a stored PDF — from placeholder tags (refined via fieldOverrides) and/or explicitly positioned fields.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The document ID |
| fieldOverrides | object | – | Per-field overrides keyed by field name |
| fields | array | – | Fields to add at explicit positions |
| preSignedUrlExpiresIn | integer | – | Generate a fresh pre-signed download URL expiring in this many seconds (60–86400) |
No output schema declared.
No examples provided.
compress_pdf ~94
Compress/optimise a PDF to reduce file size without changing visual content.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The source document ID to compress |
| linearize | boolean | – | Linearise the PDF to enable fast web view (first page renders sooner) |
| metadata | object | – | Custom metadata to attach |
| preSignedUrlExpiresIn | integer | – | Pre-signed download URL expiry in seconds (60–86400) |
No output schema declared.
No examples provided.
create_embed_link ~201
Create a short-lived signing URL for an embedded recipient, to be rendered in an iframe inside your application. The envelope must be in 'in_progress' status and the link expires after 10 minutes, so create it when the signer is ready (one link per signing session). On documents with a signingOrder the link can only be created once it is the recipient's turn; the envelope.recipient.activated webhook event signals that moment. When the session ends the iframe redirects to returnUrl with event (signing_complete, voided, expired or not_found), envelopeId, documentId and recipientId appended as query parameters; existing returnUrl query parameters are preserved.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The envelope document ID (sourceDocumentId) |
| envelopeId | string | yes | The envelope ID |
| recipientId | string | yes | The recipient ID of the embedded recipient |
| returnUrl | string | yes | URL the signing session redirects to when it ends |
No output schema declared.
No examples provided.
create_envelope ~158
Create a signing envelope from one or more existing PDFGate documents. Each recipient is given either as email and name or as the recipientId of a stored recipient. Recipients marked embedded sign inside your application via create_embed_link and receive no emails. Use signingOrder to make recipients sign in sequence. Returns an envelope in 'created' status; call send_envelope to dispatch signing emails.
| Name | Type | Req | Description |
|---|---|---|---|
| documents | array | yes | Documents to include in the envelope |
| expiresInDays | integer | – | Days until the envelope and its signing links expire, counted from creation. Defaults to the account's envelope expiration setting. |
| metadata | object | – | Custom metadata to attach |
| requesterName | string | yes | Name of the user or system creating the envelope |
No output schema declared.
No examples provided.
create_recipient ~89
Store a recipient in your account so envelopes can reference them by recipientId. Emails are not unique; every call creates a new recipient, so use list_recipients first when reuse is intended.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Recipient email address. Stored lowercased and cannot be changed later | |
| metadata | object | – | Custom metadata to attach |
| name | string | – | Recipient display name |
No output schema declared.
No examples provided.
create_webhook ~73
Create a PDFGate webhook subscription. The response includes a signing secret — store it securely to verify incoming event signatures.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Optional label to identify this webhook |
| eventTypes | array | yes | Event types to subscribe to |
| url | string | yes | The HTTPS endpoint that will receive webhook events |
No output schema declared.
No examples provided.
delete_document ~27
Delete a PDFGate document.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The document ID to delete |
No output schema declared.
No examples provided.
delete_envelope ~87
Permanently delete an envelope and the files it produced (signed documents and audit logs). Recipient data is anonymized and recipients lose access; source documents are not deleted. Only envelopes in 'draft', 'completed', 'expired', or 'voided' status can be deleted — void an active envelope first. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | The envelope ID to delete |
No output schema declared.
No examples provided.
delete_webhook ~41
Delete a PDFGate webhook subscription. Future events will no longer be delivered to the associated endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookId | string | yes | The webhook ID to delete |
No output schema declared.
No examples provided.
download_file ~46
Download the raw PDF bytes of a stored document, returned as an embedded resource. For a shareable link instead, use get_document.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The document ID |
No output schema declared.
No examples provided.
extract_form_data ~46
Extract form field values from a fillable PDF. Returns a JSON object mapping field names to their values.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The document ID of the fillable PDF |
No output schema declared.
No examples provided.
flatten_pdf ~81
Flatten an interactive PDF into a static, non-editable PDF. Creates a new document; does not overwrite the original.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The source document ID to flatten |
| metadata | object | – | Custom metadata to attach |
| preSignedUrlExpiresIn | integer | – | Pre-signed download URL expiry in seconds (60–86400) |
No output schema declared.
No examples provided.
generate_pdf ~274
Generate a PDF from a URL or raw HTML. Provide either 'url' or 'html', not both.
| Name | Type | Req | Description |
|---|---|---|---|
| css | string | – | CSS to inject before rendering |
| emulateMediaType | string | – | – |
| enableFormFields | boolean | – | Enable interactive PDF form fields from HTML |
| footer | string | – | HTML string for the page footer |
| header | string | – | HTML string for the page header |
| html | string | – | Raw HTML string to render as PDF |
| javascript | string | – | JavaScript to inject before rendering |
| marginBottom | string | – | Bottom margin |
| marginLeft | string | – | Left margin |
| marginRight | string | – | Right margin |
| marginTop | string | – | Top margin e.g. '10mm' |
| metadata | object | – | Custom metadata to attach |
| orientation | string | – | Page orientation (default: portrait) |
| pageSizeType | string | – | Page size (default: a4) |
| preSignedUrlExpiresIn | integer | – | Pre-signed download URL expiry in seconds (60–86400) |
| printBackground | boolean | – | Print background graphics (default: true) |
| url | string | – | Public URL to render as PDF |
| waitForNetworkIdle | boolean | – | Wait for network idle before rendering |
No output schema declared.
No examples provided.
get_document ~61
Retrieve metadata for a stored PDFGate document by its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The document ID |
| preSignedUrlExpiresIn | integer | – | Generate a fresh pre-signed download URL expiring in this many seconds (60–86400) |
No output schema declared.
No examples provided.
get_envelope ~84
Retrieve the current state of an envelope including its status, document progress, and per-recipient signing status. Each recipient carries an embedded boolean; embedded recipients have no signing link — mint one with create_embed_link instead. Recipients on ordered documents carry signingOrder and, once it is their turn, activatedAt.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | The envelope ID to retrieve |
No output schema declared.
No examples provided.
get_recipient ~27
Retrieve a stored recipient by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| recipientId | string | yes | The recipient ID |
No output schema declared.
No examples provided.
get_webhook ~30
Retrieve a PDFGate webhook subscription by its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookId | string | yes | The webhook ID |
No output schema declared.
No examples provided.
list_recipients ~36
List stored recipients with the given email (case-insensitive), oldest first.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email to look up |
No output schema declared.
No examples provided.
protect_pdf ~175
Encrypt a PDF with a password and optional permission restrictions. Produces a new document; the original is unchanged.
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | – | Encryption algorithm (default: AES256) |
| disableCopy | boolean | – | Prevent copying text |
| disableEditing | boolean | – | Prevent editing |
| disablePrint | boolean | – | Prevent printing |
| documentId | string | yes | The source document ID to protect |
| encryptMetadata | boolean | – | Encrypt PDF metadata (default: false) |
| metadata | object | – | Custom metadata to attach |
| ownerPassword | string | – | Full-control owner password; required when using AES256 with a userPassword |
| preSignedUrlExpiresIn | integer | – | Pre-signed download URL expiry in seconds (60–86400) |
| userPassword | string | – | Password required to open the PDF |
No output schema declared.
No examples provided.
send_envelope ~90
Send a created envelope to its recipients. PDFGate dispatches signing emails with secure, OTP-protected links that stay valid until the envelope expires. Embedded recipients receive no email; create their signing links with create_embed_link after sending. On documents with a signingOrder only the first recipients are emailed; later recipients are activated as earlier ones sign.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | The envelope ID to send |
No output schema declared.
No examples provided.
update_recipient ~72
Update a stored recipient's name or metadata. The email cannot be changed. Existing envelopes are not affected; they keep the recipient name they were created with.
| Name | Type | Req | Description |
|---|---|---|---|
| metadata | object | – | Replacement custom metadata |
| name | string | – | New recipient display name |
| recipientId | string | yes | The recipient ID |
No output schema declared.
No examples provided.
upload_file ~105
Upload a PDF to PDFGate so it can be referenced by other operations. Provide either 'filePath' (local path) or 'url'.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | – | Absolute local path to the PDF file to upload |
| metadata | object | – | Custom metadata to attach |
| preSignedUrlExpiresIn | integer | – | Pre-signed download URL expiry in seconds (60–86400) |
| url | string | – | Publicly accessible URL of the PDF to upload |
No output schema declared.
No examples provided.
void_envelope ~98
Void (cancel) an envelope in 'created' or 'in_progress' status. Recipients who have not signed are notified by email and their signing links stop working; documents already signed by all recipients are not affected. The optional reason is visible to recipients. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | The envelope ID to void |
| reason | string | – | Reason for voiding. Included in the cancellation email sent to recipients |
No output schema declared.
No examples provided.
watermark_pdf ~274
Apply a text or image watermark to a PDF. For type='text' provide 'text'; for type='image' provide 'watermarkImagePath'.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | The source document ID |
| font | string | – | Standard PDF font name |
| fontColor | string | – | Font colour as hex e.g. '#FF0000' |
| fontFilePath | string | – | Local path to a .ttf/.otf font file (overrides 'font') |
| fontSize | number | – | Font size in points |
| imageHeight | number | – | Image watermark height |
| imageWidth | number | – | Image watermark width |
| metadata | object | – | Custom metadata to attach |
| opacity | number | – | Opacity 0–1 |
| preSignedUrlExpiresIn | integer | – | Pre-signed download URL expiry in seconds (60–86400) |
| rotate | number | – | Rotation in degrees (0–360) |
| text | string | – | Watermark text (required when type='text') |
| type | string | yes | Watermark type |
| watermarkImagePath | string | – | Local path to a .png/.jpg watermark image (required when type='image') |
| xPosition | number | – | Horizontal position |
| yPosition | number | – | Vertical position |
No output schema declared.
No examples provided.
What is the com.pdfgate/mcp-server server?
com.pdfgate/mcp-server is listed in the public MCP registry as com.pdfgate/mcp-server. MCP server for the PDFGate API. Generate PDFs, manage documents and handle e-signatures. This page covers its npm package (@pdfgate/mcp-server).
Is the com.pdfgate/mcp-server server safe to use?
com.pdfgate/mcp-server scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.pdfgate/mcp-server server expose?
com.pdfgate/mcp-server exposes 24 tools: generate_pdf, upload_file, get_document, delete_document, flatten_pdf, and 19 more. Their descriptions and schemas cost roughly 2,372 tokens of context every time the server is loaded.
Is the com.pdfgate/mcp-server server still maintained?
com.pdfgate/mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.