Carbone MCP
REMOTE · MCP.CARBONE.IO · 2 COMPONENTS
Automate production-ready PDF, Word, Excel and PowerPoint documents from templates and JSON data
Available components
Last scanned (13 hours ago)
Scores higher than 26% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security92
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability0
- Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http. See how to fix → View diagnostics → Unverified
Schema Quality & AI Usability0
- Schema blocked by authentication: the endpoint requires auth we don't have to read it. See how to fix → Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Tool Safety0
- Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Capabilities0
- Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. See how to fix → Unverified
Unverified: 6 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm. Claim this server and supply a read-only token to verify it and lift the score.
Checks we ran (5)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
Checks we could not complete (6)
These are gaps on our side, not findings about this hosted endpoint. We only credit what we can confirm, so a category made up entirely of them scores 0.
- Transport in Transport & Reachability (scores 0 for this)Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http.
- Schema quality in Schema Quality & AI Usability (scores 0 for this)Schema blocked by authentication: the endpoint requires auth we don't have to read it.
- Stability in Stability & Change Management (scores 0 for this)Stability not yet verified: not enough scan history yet (needs a 30-day window).
- Tool coverage in Tool Coverage (scores 0 for this)Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.
- Tool safety in Tool Safety (scores 0 for this)Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.
- Capabilities in Capabilities (scores 0 for this)Capabilities blocked by authentication: the endpoint requires auth we don't have to read them.
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 15 Oct 26 −41
- Endpoint reachability: reachable → behind authorisation ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Transport: pass → unverified ▼ security
- Authorization: fail → pass ▲ security
- First check of Authorization: pass security
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Server version: 2.0.0 → 2.1.0 functional
- 14 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “convert_document” rewrote its description, which is the text the model reads security
- Tool “delete_template” rewrote its description, which is the text the model reads security
- Tool “download_template” rewrote its description, which is the text the model reads security
- Tool “list_tags” rewrote its description, which is the text the model reads security
- Tool “list_templates” rewrote its description, which is the text the model reads security
- Tool “render_document” rewrote its description, which is the text the model reads security
- Tool “update_template_metadata” rewrote its description, which is the text the model reads security
- Tool “upload_template” rewrote its description, which is the text the model reads security
- Schema quality: 7407 → 8440 ▼ functional
- Tool coverage: 45% → 58% ▲ functional
- Tool “update_template_metadata” now declares an output schema ▲ functional
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- MCP protocol version: 2025-11-25 → 2026-07-28 functional
- Server version: 1.6.0 → 2.0.0 functional
- New tool “inspect_template” functional
- “render_document” added an optional parameter “failOn” cosmetic
- “render_document” added an optional parameter “preReleaseFeatureIn” cosmetic
- “update_template_metadata” added an optional parameter “moveToTemplateId” cosmetic
- “render_document” reworded the description of “translations” cosmetic
- “convert_document” reworded the description of “asAttachment” cosmetic
- “convert_document” reworded the description of “convertTo” cosmetic
- “convert_document” reworded the description of “converter” cosmetic
- “convert_document” reworded the description of “egressAuthorization” cosmetic
- “convert_document” reworded the description of “file” cosmetic
- “convert_document” reworded the description of “hardRefresh” cosmetic
- “convert_document” reworded the description of “reportName” cosmetic
- “download_template” reworded the description of “outputPath” cosmetic
- “download_template” reworded the description of “sample” cosmetic
- “list_templates” reworded the description of “limit” cosmetic
- “list_templates” reworded the description of “origin” cosmetic
- “render_document” reworded the description of “asAttachment” cosmetic
- “render_document” reworded the description of “batchOutput” cosmetic
- “render_document” reworded the description of “batchReportName” cosmetic
- “render_document” reworded the description of “batchSplitBy” cosmetic
- “render_document” reworded the description of “convertTo” cosmetic
- “render_document” reworded the description of “converter” cosmetic
- “render_document” reworded the description of “currencyTarget” cosmetic
- “render_document” reworded the description of “data” cosmetic
- “render_document” reworded the description of “egressAuthorization” cosmetic
- “render_document” reworded the description of “enum” cosmetic
- “render_document” reworded the description of “keepTags” cosmetic
- “render_document” reworded the description of “reportName” cosmetic
- “render_document” reworded the description of “returnLink” cosmetic
- “render_document” reworded the description of “template” cosmetic
- “render_document” reworded the description of “variableStr” cosmetic
- “render_document” reworded the description of “webhookUrl” cosmetic
- “update_template_metadata” reworded the description of “category” cosmetic
- “update_template_metadata” reworded the description of “comment” cosmetic
- “update_template_metadata” reworded the description of “deployedAt” cosmetic
- “update_template_metadata” reworded the description of “expireAt” cosmetic
- “update_template_metadata” reworded the description of “id” cosmetic
- “update_template_metadata” reworded the description of “name” cosmetic
- “update_template_metadata” reworded the description of “tags” cosmetic
- “update_template_metadata” reworded the description of “templateId” cosmetic
- “upload_template” reworded the description of “category” cosmetic
- “upload_template” reworded the description of “comment” cosmetic
- “upload_template” reworded the description of “deployedAt” cosmetic
- “upload_template” reworded the description of “expireAt” cosmetic
- “upload_template” reworded the description of “name” cosmetic
- “upload_template” reworded the description of “sample” cosmetic
- “upload_template” reworded the description of “tags” cosmetic
- “upload_template” reworded the description of “template” cosmetic
- “upload_template” reworded the description of “versioning” cosmetic
- “upload_template” made “name” optional cosmetic
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 19 Aug 26 0
- Tool “convert_document” rewrote its description, which is the text the model reads security
- Tool “download_template” rewrote its description, which is the text the model reads security
- Schema quality: 401 → 493 ▼ functional
- Server version: 1.5.0 → 1.6.0 functional
- “convert_document” added an optional parameter “hardRefresh” cosmetic
- “convert_document” added an optional parameter “reportName” cosmetic
- “download_template” added an optional parameter “sample” cosmetic
- “render_document” added an optional parameter “keepTags” cosmetic
- “update_template_metadata” added an optional parameter “id” cosmetic
- “render_document” reworded the description of “batchReportName” cosmetic
- “convert_document” reworded the description of “convertTo” cosmetic
- “convert_document” reworded the description of “converter” cosmetic
- “convert_document” reworded the description of “file” cosmetic
- “convert_document” reworded the description of “outputPath” cosmetic
- “download_template” reworded the description of “outputPath” cosmetic
- “list_templates” reworded the description of “limit” cosmetic
- “list_templates” reworded the description of “origin” cosmetic
- “render_document” reworded the description of “batchOutput” cosmetic
- “render_document” reworded the description of “batchSplitBy” cosmetic
- “render_document” reworded the description of “complement” cosmetic
- “render_document” reworded the description of “converter” cosmetic
- “render_document” reworded the description of “currencyRates” cosmetic
- “render_document” reworded the description of “data” cosmetic
- “render_document” reworded the description of “enum” cosmetic
- “render_document” reworded the description of “outputPath” cosmetic
- “render_document” reworded the description of “template” cosmetic
- “render_document” reworded the description of “translations” cosmetic
- “upload_template” reworded the description of “template” cosmetic
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://mcp.carbone.io
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.carbone.io | CN=YR2,O=Let's Encrypt,C=US | 15 Oct 2026 | 13 Jan 2027 | RSA 2048 | SHA256-RSA | 63abb1a854b840e4f93d63e2e747a519839 |
| SANs: mcp.carbone.io | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.carbone.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| io. | DS published | 38690 | 8 | Verified |
| carbone.io. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On connection |
| HTTP status | 401 |
WWW-Authenticate challenge Bearer scope="doc_rwd", resource_metadata="https://mcp.carbone.io/.well-known/oauth-protected-resource"
Bearer scope="doc_rwd", resource_metadata="https://mcp.carbone.io/.well-known/oauth-protected-resource"| Header | Value |
|---|---|
| x-content-type-options | nosniff |
| www-authenticate | Bearer scope="doc_rwd", resource_metadata="https://mcp.carbone.io/.well-known/oauth-protected-resource" |
Protected resource metadata
| Document | https://mcp.carbone.io/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://mcp.carbone.io |
| Authorisation server | https://account.carbone.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.carbone.io | Auth required | 401 | |
| http (plaintext) | http://mcp.carbone.io | HTTPS enforced | 301 | https://mcp.carbone.io/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
convert_document Convert Document ~1,416
Convert a document to another format without storing a template. Pure conversion: no data is sent, so Carbone tags such as {d.name} are kept as written; this is also how you proof a template in another format (DOCX template → PDF, or DOCX → ODT while it stays a template). The source file can be an HTTPS URL or a base64-encoded string (local file paths are not accepted over HTTP). Use render_document instead when you need data injection ({d.field} tags resolved), translations, or batch generation. Example: { "file": "https://example.com/report.docx", "convertTo": "pdf" }. Common conversions: DOCX → PDF (add converter: "I" for the fastest conversion), XLSX → PDF, PPTX → PDF, HTML → PDF (converter: "C" for full CSS/JS rendering), DOCX → HTML, XLSX → CSV, PDF → PNG, PPTX → PNG (first slide as image), MD → PDF.
| Name | Type | Req | Description |
|---|---|---|---|
| asAttachment | boolean | – | If true, return the document as a downloadable file attachment (a base64 EmbeddedResource), for any format. Default delivery: text and png/jpg/gif/webp are returned inline; other binary outputs (PDF,… |
| convertTo | – | yes | Target output format. Valid outputs depend on the input format (e.g. HTML converts to pdf, docx or png, but not xlsx); see the conversion matrix: https://carbone.io/documentation/developer/http-api/g… |
| converter | string | – | Converter engine, used whenever the format changes (not only for PDF). If omitted, "L" is used. "L" LibreOffice: DOCX, XLSX, PPTX, ODT, ODS, ODP, ODG, MD, PDF; the only converter supporting all PDF o… |
| egressAuthorization | string | – | Value for the Authorization header Carbone adds to its OUTBOUND (egress) requests during conversion — e.g. when a Chromium HTML→PDF conversion fetches a protected external image or stylesheet. For ex… |
| file | string | yes | The document to convert. Two input forms are accepted: (1) HTTPS URL — the file is downloaded automatically, e.g. "https://example.com/file.pptx". (2) Base64-encoded string — the raw file content enc… |
| hardRefresh | boolean | – | If true, Carbone runs the converter even when the output format equals the input format, and recomputes pagination and the table of contents at the end of the conversion. Needed for PDF → PDF: withou… |
| outputPath | string | – | NOT AVAILABLE on this server, which is reached over HTTP: the converted document would be written to the server's disk instead of yours, so passing outputPath is rejected. Use asAttachment to receive… |
| reportName | string | – | Name of the delivered file, WITHOUT extension (e.g. "contract", "2026-invoice"). The document is delivered as "<reportName>.<ext>", with the extension of convertTo, used as the attachment name. This… |
| returnLink | boolean | – | If true, generate the document and return a public download URL instead of the file contents. The link is SHORT-LIVED and ONE-TIME — Carbone deletes the file after the first download — so it is meant… |
No output schema declared.
No examples provided.
delete_template Delete Template ~157
Delete a stored Carbone template. Takes effect immediately: the template is no longer listed, downloadable or renderable (404); the file itself is purged after the retention delay (Carbone Cloud: 24 hours). You can delete by Template ID (removes all versions) or by Version ID (removes only that specific version). To schedule a deletion instead, use update_template_metadata with expireAt set to a future Unix timestamp.
| Name | Type | Req | Description |
|---|---|---|---|
| templateId | string | yes | Template ID (64-bit) or Version ID (SHA-256) to delete. Template ID — deletes the template record and all its versions. Version ID — deletes only that specific version, leaving other versions intact.… |
No output schema declared.
No examples provided.
download_template Download Template ~353
Download the original source file of a stored Carbone template (e.g. the DOCX, XLSX, PPTX, or HTML file that was uploaded). Use this to inspect, edit, or back up a template. Pass a Template ID to download the currently deployed version, or a Version ID to download a specific version. Set sample: true to get the JSON sample dataset stored with the template instead of the template file.
| Name | Type | Req | Description |
|---|---|---|---|
| asAttachment | boolean | – | If true, return the template as a downloadable file attachment (base64 resource) instead of inline text/image. Useful in HTTP mode where outputPath is unavailable. Default: false. Ignored when output… |
| outputPath | string | – | NOT AVAILABLE on this server, which is reached over HTTP: the template file would be written to the server's disk instead of yours, so passing outputPath is rejected. Use asAttachment to receive the… |
| sample | boolean | – | If true, download the JSON SAMPLE DATASET saved with the template (the "sample" array passed to upload_template) instead of the template file, returned as inline JSON text by default, of the form [{… |
| templateId | string | yes | Template ID (64-bit) or Version ID (SHA-256) to download. Template ID — downloads the currently deployed version of the template. Version ID — downloads that exact version regardless of deployment st… |
No output schema declared.
No examples provided.
get_api_status API Status ~40
Check Carbone API health and version. Returns the current API version and a status message. Useful for verifying connectivity and confirming which Carbone version is active.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | Status message returned by the API. |
| version | string | yes | The running Carbone API version. |
No examples provided.
get_capabilities Capabilities ~46
Returns a summary of all Carbone capabilities: supported formats, features, tool usage examples, and links to full documentation. Call this first if you are unsure what Carbone can do.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
inspect_template Inspect Template ~405
List the Carbone tags a template uses and return a sample JSON dataset matching its structure. Call it before render_document when you do not know which data a template expects. Pass exactly one of templateId (a stored template: Template ID or Version ID) or template: an HTTPS URL or a base64-encoded string (local file paths are not accepted over HTTP). It runs one render on the Carbone account and discards the document. {t()} translation tags are not listed.
| Name | Type | Req | Description |
|---|---|---|---|
| template | string | – | Inline template to inspect, without storing it. Two input forms are accepted: (1) HTTPS URL — the file is downloaded automatically, e.g. "https://example.com/file.pptx". (2) Base64-encoded string — t… |
| templateId | string | – | The ID of a stored template to inspect. Two ID formats are accepted: (1) Template ID (64-bit) — the deployed version is inspected. (2) Version ID (SHA-256) — that exact version is inspected. Both are… |
| Name | Type | Req | Description |
|---|---|---|---|
| error | object | – | Error reported by Carbone while inspecting; only present when there is one. |
| sample | object | yes | A sample dataset matching the template structure, with placeholder values: { "data": {...}, "complement": {...} }. Pass sample.data as render_document data, and sample.complement as complement. |
| signatures | array | – | Signature fields found in the template; only present when there are any. |
| tags | array | yes | The Carbone tags of the template, as written, e.g. "{d.customer.name}", "{d.items[i].label}", "{c.company}". {t()} translation tags are not listed. |
No examples provided.
list_categories List Categories ~57
List all template categories currently in use in your Carbone account. Categories act like folders for organising templates (e.g. "invoices", "legal", "hr"). Use the returned names as the category filter in list_templates or upload_template.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | yes | Template category names in use. |
No examples provided.
list_tags List Tags ~65
List all tags currently used across templates in your Carbone account. Tags are free-form labels attached to templates (e.g. "sales", "billing", "v2"). To find the templates with a tag, call list_templates and keep the results whose `tags` include it.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| tags | array | yes | Template tag names in use. |
No examples provided.
list_templates List Templates ~349
List stored Carbone templates with filtering, search, and pagination. Filter by Template ID, Version ID, category, or upload origin. Use includeVersions to see the full version history of each template. Supports cursor-based pagination for large collections. Each result carries its `tags`: to find templates by tag, keep the results whose `tags` include it (list_tags lists the tags in use). Note: templates uploaded with versioning disabled appear with id = null and are identified only by their versionId — pass that versionId where a Template ID is expected (e.g. delete_template, download_template).
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category (e.g. "invoices", "legal"). |
| cursor | string | – | Pagination cursor from the previous response nextCursor field. Use to fetch the next page. |
| id | string | – | Filter by Template ID (64-bit format). Cannot be a Version ID. |
| includeVersions | boolean | – | If true, returns all versions for each template. Default: false (only deployed version). |
| limit | integer | – | Maximum number of results to return, between 1 and 100 (Carbone API limit). Default: 100. Use cursor to page beyond that. |
| origin | integer | – | Filter by upload origin: 0 = API, 1 = Carbone Studio, 2 = Salesforce integration, 3 = Odoo integration, 4 = HubSpot integration. Templates uploaded through this MCP server are origin 0. |
| search | string | – | Fuzzy search in template names, or exact match on Template ID / Version ID. |
| versionId | string | – | Filter by Version ID (SHA-256 format). |
| Name | Type | Req | Description |
|---|---|---|---|
| hasMore | boolean | yes | Whether more results are available via the cursor. |
| nextCursor | string | – | Cursor to pass to the next list_templates call. |
| templates | array | yes | The matching templates (all fields). |
No examples provided.
render_document Generate Document ~3,652
Generate a document by merging a Carbone template with JSON data. Two modes: (1) pass templateId to use a previously uploaded template; (2) pass template (an HTTPS URL or a base64-encoded string (local file paths are not accepted over HTTP)) to upload and render in a single request without storing a template. Supports output format conversion, multilingual rendering, currency conversion, batch generation, and advanced PDF options (watermark, password, PDF/A). Without data, every tag resolves to empty; to keep the tags as written, pass keepTags: true (e.g. to proof a stored template), or use convert_document for a file. Async mode: pass webhookUrl. This tool then returns only Carbone's acceptance message, never the document: Carbone POSTs { "success": true, "data": { "renderId": "..." } } to the webhook, whose server downloads the document itself from GET /render/{renderId} (one-time, no auth). You cannot fetch it from here. Batch generation (batchSplitBy) is always delivered this way.
| Name | Type | Req | Description |
|---|---|---|---|
| asAttachment | boolean | – | If true, return the document as a downloadable file attachment (a base64 EmbeddedResource), for any format. Default delivery: text and png/jpg/gif/webp are returned inline; other binary outputs (PDF,… |
| batchOutput | string | – | Batch result type, with batchSplitBy. "zip" (default): an archive of all generated documents. "pdf": the generated PDFs concatenated into one file; requires convertTo "pdf". |
| batchReportName | string | – | Name of each file inside the batch ZIP, WITHOUT extension (Carbone appends it). Carbone tags are resolved against each batch item, e.g. "invoice-{d.id}". Ignored when batchOutput is "pdf". From v5.14… |
| batchSplitBy | string | – | Batch generation: one document per object of an array. Use "d" when data itself is an array, or "d.items" for a direct child array of data. Requires webhookUrl (batch is always asynchronous: the resu… |
| complement | – | – | Extra data object accessible in templates with {c.field} tags (as opposed to {d.field} for main data). Useful for static or shared values that should not be mixed into the main dataset: company info,… |
| convertTo | – | – | Output format. If omitted, the output keeps the template format. Valid outputs depend on the input format (e.g. HTML converts to pdf, docx or png, but not xlsx); see the conversion matrix: https://ca… |
| converter | string | – | Converter engine, used whenever the format changes (not only for PDF). If omitted, "L" is used. "L" LibreOffice: DOCX, XLSX, PPTX, ODT, ODS, ODP, ODG, MD, PDF; the only converter supporting all PDF o… |
| currencyRates | – | – | Exchange rate table used by :formatC for currency conversion. Keys are ISO 4217 currency codes; values are rates relative to a common base. The base currency should have rate 1. Example: { "EUR": 1,… |
| currencySource | string | – | ISO 4217 currency code of the monetary amounts in the JSON data. Used by the :formatC formatter as the conversion source. Must be set together with currencyTarget and currencyRates. Example: "EUR" if… |
| currencyTarget | string | – | ISO 4217 currency code of the output document. The :formatC formatter converts amounts from currencySource to this currency using currencyRates. Must be set together with currencySource and currencyR… |
| data | – | – | JSON data merged into the template — an object, or a top-level array (accessed with {d[i].field}). Access fields with {d.fieldName} tags. Nested objects: {d.customer.name}. Array loops: {d.items[i].d… |
| egressAuthorization | string | – | Value for the Authorization header Carbone adds to its OUTBOUND (egress) requests while rendering — fetching external images ({d.imageUrl}), external PDFs (:appendFile / :attachFile), and calling web… |
| enum | – | – | Enumeration map used with the :convEnum(TYPE) formatter to translate code values into human-readable labels. Define one key per enum type; each value is an object mapping code → label. Example: { "ST… |
| failOn | array | – | Conditions that stop the render and return an error (Carbone v5.15.0+). "IMAGE_URL_ERROR": an image that cannot be downloaded from its URL fails the render, instead of being replaced with the broken-… |
| hardRefresh | boolean | – | If true, Carbone recomputes pagination and refreshes the table of contents after rendering. Requires convertTo to be defined. Use this for DOCX/ODT templates that contain a TOC field or cross-referen… |
| keepTags | boolean | – | If true, SKIP templating entirely and leave every Carbone tag in the document exactly as written: {d.customer} comes out as the literal text "{d.customer}", formatters included. Use it to proof a sto… |
| lang | string | – | Locale of the generated document. Affects three things: (1) {t(key)} translation tags — selects the matching translation from the translations map. (2) :formatN number formatter — applies locale-spec… |
| outputPath | string | – | NOT AVAILABLE on this server, which is reached over HTTP: the generated document would be written to the server's disk instead of yours, so passing outputPath is rejected. Use asAttachment to receive… |
| preReleaseFeatureIn | integer | – | Pre-release feature level for this render only: features and fixes introduced up to this tag apply, later ones stay disabled. Overrides the server default; a tag set in the template overrides it. Exa… |
| reportName | string | – | Filename (WITHOUT extension) for the generated document, returned in the Content-Disposition header. Carbone automatically appends the extension that matches convertTo, so do not include one — passin… |
| returnLink | boolean | – | If true, generate the document and return a public download URL instead of the file contents. The link is SHORT-LIVED and ONE-TIME — Carbone deletes the file after the first download — so it is meant… |
| template | string | – | Inline template for one-shot render without storing a template first. Two input forms are accepted: (1) HTTPS URL — the file is downloaded automatically, e.g. "https://example.com/file.pptx". (2) Bas… |
| templateId | string | – | The ID of a previously uploaded template to render. Two ID formats are accepted: (1) Template ID (64-bit) — stable identifier shared across versions; Carbone automatically uses the deployed version.… |
| timezone | string | – | IANA timezone used to convert dates in the rendered document. Default: "Europe/Paris". Applied when templates use the :formatD formatter, e.g. {d.date:formatD(YYYY-MM-DD HH:mm)}. Common values: "UTC"… |
| translations | – | – | Translation map for multilingual documents. Requires "lang" to be set to select the active locale. Top-level keys are BCP-47 locale codes; values are key → translated-string maps. Template usage: {t(… |
| variableStr | string | – | Carbone alias definitions applied to the whole template, as if written in it. An alias is a shortcut to a data path, not a variable: it stores no value and computes nothing (no arithmetic, no concate… |
| webhookHeaders | object | – | Custom headers Carbone will include when POSTing to your webhookUrl. Pass plain header names as keys — the prefix "carbone-webhook-header-" is added automatically before sending to Carbone, and Carbo… |
| webhookUrl | string | – | Webhook URL that enables asynchronous rendering (render timeout raised to 5 minutes). This tool then returns only Carbone's acceptance message, never the document. When the document is ready, Carbone… |
No output schema declared.
No examples provided.
update_template_metadata Update Template Metadata ~563
Update the metadata of ONE stored template version: name, comment, category, tags, deployment (deployedAt), scheduled deletion (expireAt), or the Template ID it belongs to (moveToTemplateId). With a Template ID, Carbone patches its currently deployed version only; with a Version ID, that exact version. Use deployedAt to choose the version used when rendering by Template ID. Returns the patched versionId and the updated fields, as echoed back by Carbone. To delete a template now, use delete_template.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | New category, max 200 characters. |
| comment | string | – | New free-text comment, max 200 characters. |
| deployedAt | integer | – | Unix timestamp (seconds) to set as the deployment time for this version. Carbone picks the version with the most recent deployedAt when rendering by Template ID. Use 42000000000 to deploy immediately… |
| expireAt | integer | – | Schedule deletion of the patched version at a UTC Unix timestamp (seconds). After that time it is no longer listed, downloadable or renderable (404), and the file is purged after the retention delay.… |
| id | string | – | DEPRECATED: the 1.6.0 name of moveToTemplateId, kept so existing callers keep working. Use moveToTemplateId; passing both with different values is rejected. |
| moveToTemplateId | string | – | CAUTION, structural change: moves the patched version to this other Template ID (64-bit; a Version ID is rejected). It is NOT the template to patch (that is templateId). Pass the version's Version ID… |
| name | string | – | New display name, max 200 characters. |
| tags | array | – | New list of tags, replacing the existing ones. Duplicates are removed and the list is sorted; the whole list is limited to 100 characters (about 8 tags of 9 characters). |
| templateId | string | yes | Template ID (64-bit) or Version ID (SHA-256) of the version to update. A Template ID patches only its currently deployed version (not every version). A Version ID patches that exact version. |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Category, returned if updated. |
| comment | string | – | Comment, returned if updated. |
| deployedAt | number | – | Deployment timestamp, returned if updated. |
| expireAt | number | – | Deletion timestamp (0 = never expires), returned if updated. |
| id | string | – | Template ID the version now belongs to (returned when moveToTemplateId was used). |
| name | string | – | Name, returned if updated. |
| tags | array | – | Tags, returned if updated. |
| versionId | string | yes | Version ID of the patched version. |
No examples provided.
upload_template Upload Template ~808
Upload and store a reusable Carbone template. Once uploaded, use render_document with the returned Template ID to generate documents from it. Supports versioning: multiple versions can live under a single stable Template ID, and rendering by Template ID uses the version with the most recent deployedAt. A result deployedAt of 0 means the version is not explicitly deployed: if another version of the same Template ID is deployed, renders by Template ID keep using that one. Accepted formats: DOCX, XLSX, PPTX, ODT, ODS, ODP, ODG, HTML, XHTML, XML, SVG, IDML, Markdown, TXT, CSV, RTF and PDF (not the legacy binary DOC, XLS or PPT).
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Group templates into folders/categories, max 200 characters (e.g. "invoices", "legal", "hr"). |
| comment | string | – | Free-text comment to describe the template version or its purpose, max 200 characters. |
| deployedAt | integer | – | UTC Unix timestamp (seconds) to set as the deployment time for this version. Carbone uses the version with the most recent deployedAt when rendering via Template ID. Use 42000000000 to deploy immedia… |
| expireAt | integer | – | Schedule deletion at a UTC Unix timestamp (seconds); 0 (default) means the template never expires. After that time it is no longer listed, downloadable or renderable (404), and the file is purged aft… |
| id | string | – | Existing Template ID (64-bit format) to add this upload to its version history. If omitted, a new Template ID is generated. Providing a Version ID (SHA-256) is not allowed and will cause an error. |
| name | string | – | Display name for the template, max 200 characters (e.g. "Invoice Template", "NDA Contract"). Optional but recommended: list_templates shows it and its search matches it. |
| sample | array | – | Sample input data attached to the template for testing in Carbone Studio: an array with at most ONE object, whose keys data, complement, translations and enum are all optional. Example: [{ "data": {… |
| tags | array | – | Labels shown by list_tags and on each list_templates result (e.g. ["sales", "billing", "v2"]). Duplicates are removed and the list is sorted; the whole list is limited to 100 characters (about 8 tags… |
| template | string | yes | The template file. Two input forms are accepted: (1) HTTPS URL — the file is downloaded automatically, e.g. "https://example.com/file.pptx". (2) Base64-encoded string — the raw file content encoded a… |
| versioning | boolean | – | Enable template versioning (default: true). When true, a stable Template ID is generated and multiple versions can be managed under it. When false, behaves as legacy mode and returns only a templateI… |
| Name | Type | Req | Description |
|---|---|---|---|
| createdAt | number | – | UTC Unix timestamp (seconds) of the upload. |
| deployedAt | number | – | UTC Unix timestamp of deployment; 0 means this version is not explicitly deployed. |
| id | string | – | Stable Template ID (when versioning is enabled). |
| name | string | – | Template display name, when one was given. |
| size | number | – | Template size in bytes. |
| templateExtension | string | – | Detected file extension, e.g. "docx" (legacy/non-versioned mode). |
| templateId | string | – | Template ID returned in legacy/non-versioned mode. |
| type | string | – | Detected template file type. |
| versionId | string | – | Version ID (SHA-256) of this uploaded version. |
No examples provided.
How do I install the Carbone MCP server?
Carbone MCP is a hosted endpoint at https://mcp.carbone.io/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.carbone.io
claude mcp add --transport http io-carbone-carbone-mcp 'https://mcp.carbone.io/'
What is the Carbone MCP server?
Carbone MCP is listed in the public MCP registry as io.carbone/carbone-mcp. Automate production-ready PDF, Word, Excel and PowerPoint documents from templates and JSON data. This page covers its hosted endpoint (https://mcp.carbone.io).
Is the Carbone MCP server safe to use?
Carbone MCP scores 37 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Carbone MCP server expose?
Carbone MCP exposes 12 tools: list_templates, convert_document, render_document, inspect_template, list_categories, and 7 more. Their descriptions and schemas cost roughly 7,911 tokens of context every time the server is loaded.
Does the Carbone MCP server require authentication?
Yes. Carbone MCP asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Carbone MCP server still maintained?
Carbone MCP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the Carbone MCP server?
VerifyMCP ran 5 checks on Carbone MCP, covering TLS certificate, Authorization, HTTPS, HSTS header and 1 more. 6 items could not be completed, a gap on our side rather than a finding about Carbone MCP: Transport, Schema quality, Stability, Tool coverage and 2 more. 6 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.