# PDF Generator (npm · @mcp-z/mcp-pdf)

MCP server for creative PDF generation with full emoji, Unicode, and offline support

- Trust score: 55/100 (low)
- Change this week: +55
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@mcp-z/mcp-pdf`: 55/100 (this document), [markdown](https://verifymcp.io/servers/mcp-z-mcp-pdf/mcp-z-mcp-pdf.md), [page](https://verifymcp.io/servers/mcp-z-mcp-pdf/mcp-z-mcp-pdf)

## Channel facts

- Registry: `npm`
- Package: `@mcp-z/mcp-pdf`
- Version: `2.0.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 73/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects pdfjs-dist 5.6.205, reached via pdf-to-png-converter > pdfjs-dist. A fixed version is available.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - Dependency health was assessed across the 185 of 186 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 202 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1232 tokens (~246/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 97% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add mcp-z-mcp-pdf -- npx -y @mcp-z/mcp-pdf
```

### Codex

```bash
codex mcp add mcp-z-mcp-pdf -- npx -y @mcp-z/mcp-pdf
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mcp-z-mcp-pdf": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mcp-z/mcp-pdf"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mcp-z-mcp-pdf --command npx --arg -y --arg @mcp-z/mcp-pdf
```

### Hermes

```yaml
mcp_servers:
  mcp-z-mcp-pdf:
    command: "npx"
    args: ["-y", "@mcp-z/mcp-pdf"]
```

### Other

```json
{
  "mcpServers": {
    "mcp-z-mcp-pdf": {
      "command": "npx",
      "args": [
        "-y",
        "@mcp-z/mcp-pdf"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 55, −3)

- [security regression] CVE-2026-16633 affects this package: high
- [security regression] Known CVEs: partial → fail

### 2026-08-06 (score 58, +30)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 97
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: good

### 2026-08-02 (score 28, +28)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → partial
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] The scripts that run when this package is installed changed: postinstall
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 0, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 0, −18)

- [security regression] Malware scan: pass → unverified
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.

### 2026-07-28 (score 18, 0)

- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.

### 2026-07-27 (score 18)

First indexed and scored.

## MCP tools (5)

### `pdf-document` (~307 tokens)

Create PDF Document

Create a flowing PDF document with automatic pagination.

Best for: Reports, articles, letters, contracts, and documents with sequential content.

Content flows naturally from top to bottom. Pages break automatically when content exceeds page height. Use "pageBreak" to force page breaks, "divider" for horizontal rules, and "spacer" for vertical spacing.

Supported content types:
\- text: Body text with optional formatting (bold, italic, color, alignment)
\- heading: Section headings (larger font, bold by default)
\- image: Inline images that flow with content
\- divider: Horizontal line separators
\- spacer: Vertical whitespace
\- pageBreak: Force new page

Default margins: Varies by page size (e.g., 72pt/1" for Letter, ~56pt for A4).

Input parameters:

- `author` (string): Document author metadata
- `color` (object): Color settings for the PDF
- `content` (array, required): Document content in flow order
- `filename` (string): Optional logical filename (metadata only). Storage uses UUID. Defaults to "document.pdf".
- `font` (string): Font strategy (default: auto). Built-ins: Helvetica, Times-Roman, Courier. Use a path or URL for Unicode.
- `markdown` (boolean): Enable markdown parsing (links, **bold**, *italic*). Default: false.
- `pageSetup` (object): Page configuration including size and margins.
- `title` (string): Document title metadata

Output parameters:

- `result` (object)

### `pdf-image` (~304 tokens)

Convert PDF to Image

Generate PNG image(s) from PDF pages.

Use this to visually verify PDF output without opening external applications.

\**Pages Options:**
\- Single page: `pages: 1` or `pages: 3`
\- Multiple pages: `pages: [1, 3, 5]`
\- All pages: `pages: "all"`
\- Default: page 1 only

\**Viewport Scale Recommendations:**
\- **0.25 (thumbnail)**: ~150px wide, smallest file (~15-30KB). Use for quick verification.
\- **0.5 (preview)**: ~300px wide, good balance (~40-80KB). **Recommended default.**
\- **1.0 (full)**: ~612px wide, detailed view (~150-300KB). Use when details matter.

Lower scales produce smaller files, reducing context usage when sharing images.

Input parameters:

- `pages`: Pages to render: single number (e.g., 1), array (e.g., [1, 3, 5]), or "all". Default: 1
- `pdfPath` (string, required): Absolute path to the PDF file
- `viewportScale` (number): Scale factor for the image. Recommended: 0.25 (thumbnail, ~150px wide, smallest), 0.5 (preview, ~300px wide, good balance), 1.0 (full size, ~612px wide). Default: 0.5

Output parameters:

- `images` (array): Array of generated images
- `totalPages` (number): Total pages rendered

### `pdf-layout` (~261 tokens)

Create PDF Layout

Create a PDF with precise positioning using Yoga flexbox layout.

Best for: Dashboards, slides, certificates, flyers, and designs requiring exact placement.

All items are positioned absolutely on specific pages. Use the "page" property to target different pages (e.g., page: 2 for multi-slide presentations). Pages are created as needed.

Use groups for flexbox containers - they support direction, gap, justify, alignItems, and alignment properties for sophisticated layouts.

Default margins: 0 (full canvas access for precise positioning).

Input parameters:

- `author` (string): Document author metadata
- `color` (object): Color settings for the PDF
- `content` (array, required)
- `filename` (string): Optional logical filename (metadata only). Storage uses UUID. Defaults to "document.pdf".
- `font` (string): Font strategy (default: auto). Built-ins: Helvetica, Times-Roman, Courier. Use a path or URL for Unicode.
- `layout` (object): Layout configuration for overflow handling
- `markdown` (boolean): Enable markdown parsing (links, **bold**, *italic*). Default: false.
- `pageSetup` (object): Page configuration including size, margins, and background color.
- `title` (string): Document title metadata

Output parameters:

- `result` (object)

### `pdf-resume` (~229 tokens)

Generate Resume PDF

Generate a professional resume PDF from JSON Resume format. Supports layout customization, date/locale formatting, styling, fonts, and automatic page breaks.

Input parameters:

- `color` (object): Color settings for the PDF
- `filename` (string): Optional logical filename (metadata only). Storage uses UUID. Defaults to "resume.pdf".
- `font` (string): Font for the PDF. Defaults to "auto" (system font detection). Built-ins are limited to ASCII; provide a path or URL for full Unicode.
- `layout` (object): Spatial arrangement of sections. Omit for single-column (default). Use style: "two-column" with columns config for sidebar layouts.
- `markdown` (boolean): Enable markdown parsing (links, **bold**, *italic*). Default: false.
- `pageSize` (string): Page size preset (default: "LETTER"). Use "A4" for international standard.
- `resume` (object, required): Resume data in JSON Resume format
- `sections` (object): Sections configuration for section ordering and field templates
- `styling` (object): Typography and styling options

Output parameters:

- `result` (object)

### `text-measure` (~131 tokens)

Measure Text Dimensions

Measure text width and height before rendering.

Returns exact dimensions based on font, font size, and text content. Use this to:
\- Calculate text width to set proper container sizes
\- Determine if text will fit in a given space
\- Plan multi-line layouts by specifying width constraint

Width is measured as single-line natural width. Height accounts for text wrapping when width is specified.

Input parameters:

- `font` (string): Font specification (default: auto). Built-ins: Helvetica, Times-Roman, Courier. Use a path or URL for custom fonts.
- `items` (array, required): Array of text items to measure

Output parameters:

- `font` (string): Font used for measurements
- `measurements` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/mcp-z-mcp-pdf/mcp-z-mcp-pdf#diagnostics

## Score history

- 2026-08-07: 55
- 2026-08-06: 58
- 2026-08-05: 28
- 2026-08-04: 28
- 2026-08-03: 28
- 2026-08-02: 28
- 2026-08-01: 0
- 2026-07-31: 0
- 2026-07-30: 18
- 2026-07-28: 18
- 2026-07-27: 18

## Links

- npm package: https://www.npmjs.com/package/@mcp-z/mcp-pdf
- Socket report: https://socket.dev/npm/package/@mcp-z/mcp-pdf
- Website: https://github.com/mcp-z/mcp-pdf#readme
- Changelog RSS feed: https://verifymcp.io/servers/mcp-z-mcp-pdf/mcp-z-mcp-pdf.xml
- Changelog JSON feed: https://verifymcp.io/servers/mcp-z-mcp-pdf/mcp-z-mcp-pdf.json
- HTML version of this page: https://verifymcp.io/servers/mcp-z-mcp-pdf/mcp-z-mcp-pdf