# AILANG Parse (remote · docparse.ailang.sunholo.com)

Deterministic DOCX/PPTX/XLSX/PDF parser: track changes, comments, headers, footers, merged cells.

- Trust score: 62/100 (medium)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `docparse.ailang.sunholo.com`: 62/100 (this document), [markdown](https://verifymcp.io/servers/sunholo-data-parse/docparse.md), [page](https://verifymcp.io/servers/sunholo-data-parse/docparse)
- npm · `@ailang/parse`: 49/100, [markdown](https://verifymcp.io/servers/sunholo-data-parse/ailang-parse.md), [page](https://verifymcp.io/servers/sunholo-data-parse/ailang-parse)
- pypi · `ailang-parse`: 36/100, [markdown](https://verifymcp.io/servers/sunholo-data-parse/ailang-parse-2.md), [page](https://verifymcp.io/servers/sunholo-data-parse/ailang-parse-2)

## Channel facts

- Endpoint: `https://docparse.ailang.sunholo.com/mcp/`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.8.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 31 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 67/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 2941 tokens (~91/item across 32 items; 31 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 13% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http sunholo-data-parse https://docparse.ailang.sunholo.com/mcp/
```

### Codex

```toml
[mcp_servers.sunholo-data-parse]
url = "https://docparse.ailang.sunholo.com/mcp/"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sunholo-data-parse": {
      "type": "remote",
      "url": "https://docparse.ailang.sunholo.com/mcp/",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sunholo-data-parse --url https://docparse.ailang.sunholo.com/mcp/ --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  sunholo-data-parse:
    url: "https://docparse.ailang.sunholo.com/mcp/"
```

### Other

```json
{
  "mcpServers": {
    "sunholo-data-parse": {
      "type": "http",
      "url": "https://docparse.ailang.sunholo.com/mcp/"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 61, +2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 59, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 57, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 57)

First indexed and scored.

## MCP tools (31)

### `agentCard` (~104 tokens)

A2A Agent Card for agent-to-agent discovery.
Returns a hand-crafted Agent Card with AILANG Parse-specific skills,
supported formats, and capability descriptions.
@raw: return raw JSON (no {result:..., elapsed_ms:N} envelope) for A2A compliance.
Switch to @nowrap once available (lighter than @raw). If using --a2a flag, the
built-in route takes precedence (collision guard skips this).

Input parameters:

- `_` (string, required)

### `apiSamples` (~45 tokens)

Sample files inventory — delegates to the upstream package.
Package @route annotations don't auto-register with serve-api, so we provide
a local wrapper here.

Input parameters:

- `_` (string, required)

### `apiTools` (~39 tokens)

Tool definitions for Claude, OpenAI, MCP, and A2A agent frameworks.
Delegates to the upstream package.

Input parameters:

- `_` (string, required)

### `capabilities` (~25 tokens)

capabilities(() -> string ! {Env}) [pure]

Input parameters:

- `_` (string, required)

### `deviceAuthApprove` (~79 tokens)

Approve a device authorization request.
Called by the browser approval page after user signs in and confirms.
Verifies Firebase ID token from Authorization header to ensure the
caller is a real authenticated user. Extracts uid from the verified token.
Dev mode: ALLOW_SELF_APPROVE=true skips Firebase verification (for testing).

Input parameters:

- `req` (object, required)

### `deviceAuthInspect` (~124 tokens)

Look up a pending device code by user_code and return its provenance.
No authentication required — possession of the user_code is the proof.
The dashboard /approve.html page calls this BEFORE showing the approve UI
so the user can see where the request came from (IP, User-Agent, Referer,
age) and decide whether to trust it.

Returns 404 if the user_code does not match any pending device_codes doc.
Already-approved or expired codes return as INPUT_NOT_FOUND too — there is
nothing to inspect after the fact.

Input parameters:

- `userCode` (string, required)

### `deviceAuthPoll` (~54 tokens)

Poll for device authorization approval.
Returns AUTHORIZATION_PENDING if user hasn't approved yet.
Returns DEVICE_CODE_EXPIRED if the code has timed out.
Returns approved status with API key on success.

Input parameters:

- `deviceCode` (string, required)

### `deviceAuthRequest` (~44 tokens)

Request a device authorization code.
Returns device_code, user_code, and verification URL.
The agent should display the verification_url to the user.

Input parameters:

- `req` (object, required)

### `editDocument` (~192 tokens)

Parse a document, apply JSON edit deltas, and return the modified blocks
as JSON (same format as POST /api/v1/parse with outputFormat=blocks).

filepath: uploaded file path (multipart upload).
deltas:   JSON array of edit operations — see edit_apply.ail for format.
          Empty array or "" → round-trip (parse + return unchanged blocks).
apiKey:   dp_ API key.

Response: modified blocks JSON. Use the AILANG SDK or CLI to generate a
file from the returned blocks (e.g. ailang run ... --convert output.docx).

Only deterministic office formats are supported (docx, pptx, xlsx, odt, odp, ods).
AI-required formats (pdf, image, audio, video) are rejected.

Input parameters:

- `apiKey` (string, required)
- `deltas` (string, required)
- `filepath` (string, required)

### `estimate` (~39 tokens)

estimate((string, string) -> string ! {Clock, FS}) [pure]

Input parameters:

- `filepath` (string, required)
- `outputFormat` (string, required)

### `formats` (~57 tokens)

List all supported document formats for parsing and generation.
Returns: parse formats (13), generate formats (9), output formats (blocks/markdown/html/a2ui),
and which formats require AI (PDF, images).

Input parameters:

- `_` (string, required)

### `getKeyUsage` (~46 tokens)

Get usage stats for a user's API key. Accepts Firebase JWT or apiKey.
Verifies that the requested keyId belongs to the authenticated user.

Input parameters:

- `req` (object, required)

### `getUploadUrl` (~95 tokens)

Request a pre-authenticated GCS upload URL for direct file upload.
Business tier only. The returned URL allows the client to PUT file content
directly to GCS, bypassing the 32MB Cloud Run request limit.
After upload, pass the gcs_ref to POST /api/v1/parse.

Input parameters:

- `apiKey` (string, required)
- `filename` (string, required)
- `mimeType` (string, required)

### `health` (~124 tokens)

Health check for the AILANG Parse API.
Returns service status, version, AILANG commit hash, supported format counts,
and billing catalog status. `billing_catalog_loaded` is FALSE when the
BILLING_PLAN_CATALOG env var is unset or parses to an empty list — in that
mode every authenticated request silently falls back to the safety-net
"fallback" plan (limit=1) and is rejected as over-quota. release.sh asserts
\`billing_catalog_loaded == true` after every promotion to catch this regressing.

Input parameters:

- `_` (string, required)

### `listApiKeys` (~82 tokens)

List API keys for a user. Accepts either:
  \- Authorization: Bearer <firebase_id_token>  (dashboard path)
  \- {apiKey: "..."} or {args: ["dp_..."]} in body  (CLI/SDK path)
The resolved userId filters the Firestore query server-side.

Input parameters:

- `req` (object, required)

### `mcpAccount` (~108 tokens)

View account info, pricing, entitlements, or list keys.
Actions:
  "status"  (default) → tier, quota, usage from /me/entitlements
  "pricing"           → public pricing tiers (no auth required)
  "keys"              → list user's API keys with per-key usage
  "usage"             → alias for "keys" (per-key usage is shown there)

Input parameters:

- `action` (string, required)
- `apiKey` (string, required)

### `mcpAuth` (~82 tokens)

Start device authorization to get an API key.
Returns device_code, user_code, and verification URL.
The agent should display the verification URL to the user, who signs in
and approves the code. Then call mcpAuthPoll with the device_code.
MCP wrappers don't have HTTP request headers, so provenance is empty here.

Input parameters:

- `label` (string, required)

### `mcpAuthPoll` (~58 tokens)

Poll for device authorization completion.
Returns "pending" (keep polling every 5s), "approved" (with api_key and tier),
or "expired" (start over with mcpAuth).

Input parameters:

- `deviceCode` (string, required)

### `mcpConvert` (~85 tokens)

Convert is not supported on the hosted server (no persistent local filesystem
to write the output file to). Use the local stdio SDK (@ailang/parse) for
local conversions, where the user has filesystem access.

Input parameters:

- `apiKey` (string, required)
- `input` (string, required)
- `outputFormat` (string, required)
- `outputPath` (string, required)

### `mcpEstimate` (~46 tokens)

Estimate cost and latency for parsing a document.
Accepts a file path or sample_id. No auth required.

Input parameters:

- `filepath` (string, required)
- `outputFormat` (string, required)

### `mcpFormats` (~59 tokens)

List supported formats, samples, and service capabilities.
Pure JSON, no auth required. Delegates to package implementation.
Single source of truth lives in pkg/sunholo/ailang_parse/services/mcp/tools.

Input parameters:

- `_` (string, required)

### `mcpParse` (~105 tokens)

Parse a document. Accepts a file path or sample_id (e.g. "sample_docx_formatting").
The hosted server requires a valid dp_ API key — get one via mcpAuth.
Output formats: blocks (default), markdown, html, a2ui.
requestId is reserved for future replay support.

Input parameters:

- `apiKey` (string, required)
- `filepath` (string, required)
- `outputFormat` (string, required)
- `requestId` (string, required)

### `myEntitlements` (~64 tokens)

Get the authenticated user's billing entitlements, usage, and plan details.
Returns: plan name, monthly request limit, requests used, remaining requests, upgrade/manage URLs.
Requires a valid AILANG Parse API key (dp_ prefix).

Input parameters:

- `apiKey` (string, required)

### `parseFileSecure` (~424 tokens)

Parse a document. Requires a valid API key.
Validates the key, checks entitlement quotas, logs for replay.
filepath: file path OR sample_id (e.g. "sample_docx_formatting" → resolved via /api/v1/samples).
outputFormat: "blocks", "markdown", "html", or "a2ui".
editable: "true" to emit editable A2UI component variants with block_index props; only meaningful when outputFormat="a2ui".
gcsRef: optional gs:// URI for Business tier large file uploads (>32MB).
  When provided, the file is downloaded from GCS via our service account.
  Business tier only — Free/Pro users get TIER_UPGRADE_REQUIRED error.
sourceUrl: optional https:// URL (e.g., a signed GCS URL or any public file).
  When provided, the file is fetched over HTTPS by docparse and parsed.
  Available on all tiers; tier dictates the max fetched-file size.
  Cannot be combined with gcsRef or filepath — sourceUrl wins.
pdfBackend: optional PDF extraction backend override.
  ""           — use server default (DOCPARSE_PDF_BACKEND env var, default "pdftotext").
  "pdftotext"  — deterministic text extraction via poppler. Fast, no AI cost.
  "docling"    — IBM Docling layout analysis. No AI cost.
  "liteparse"  — run-llama LiteParse. No AI cost.
  "ai"         — Gemini multimodal via Vertex AI. Required for scanned/image-only PDFs.
  Explicit non-"ai" selection returns an error on failure (no silent AI fallback).
@nowrap: raw JSON (no envelope), _headers extracted as HTTP response headers.

Input parameters:

- `apiKey` (string, required)
- `editable` (string, required)
- `filepath` (string, required)
- `gcsRef` (string, required)
- `outputFormat` (string, required)
- `pdfBackend` (string, required)
- `sourceUrl` (string, required)

### `partitionGeneral` (~142 tokens)

Unstructured API-compatible endpoint (drop-in replacement for Unstructured.io).
Returns elements in Unstructured JSON format (Title, NarrativeText, Table, ListItem, etc.).
Accepts file upload (multipart/form-data) or JSON body with filepath/sample_id.
API key: via unstructured-api-key header (Unstructured convention) or apiKey form field.
strategy parameter: "auto" (default), "hi_res", "fast", "ocr_only".
Uses _headers for header access while keeping @route multipart support.

Input parameters:

- `_headers` (object, required)
- `apiKey` (string, required)
- `filepath` (string, required)
- `strategy` (string, required)

### `pricing` (~22 tokens)

pricing(() -> string) [pure]

Input parameters:

- `_` (string, required)

### `requestHistory` (~104 tokens)

List recent parse requests for a user. Returns up to 50 entries.
Accepts Firebase ID token (dashboard) OR dp_ API key (programmatic).
Dashboard sends Authorization: Bearer <firebase_token> with {args: [uid]}.
API clients send {args: [apiKey]}.
Uses Firestore structured query to filter by user_id server-side
and order by timestamp descending. Only reads matching docs (not full scan).

Input parameters:

- `req` (object, required)

### `requestReplay` (~79 tokens)

Retrieve a stored request/response pair for replay.
Requires authentication: Firebase JWT or dp_ API key.
The request must belong to the authenticated user (user_id match).
Accepts optional outputFormat (blocks/markdown/html/a2ui) to re-render
the stored blocks server-side using the ailang_parse pipeline.

Input parameters:

- `req` (object, required)

### `revokeApiKey` (~36 tokens)

Revoke an API key by keyId. Authenticates via either Firebase JWT or apiKey.

Input parameters:

- `req` (object, required)

### `rotateApiKey` (~34 tokens)

Rotate an API key: generate new key, revoke old one, preserve tier + usage.

Input parameters:

- `req` (object, required)

### `submit_feedback` (~325 tokens)

Anonymous bug report / feature request / docs gap, queued for human review. Default routing: `public-feedback` inbox (general AILANG). Pass `package="vendor/name"` (e.g. "sunholo/auth") to route to that package's `pkg:vendor/name` inbox where its autonomous agent watches. Categories: bug, feature, docs, limitation. Body limit 10KB, snippet limit 4KB. Optional contact field for follow-up; opaque to the server. Set `auto_dispatch=true` to authorize the package agent to act on your submission immediately (default false — files for human triage; pkg-feedback agent template lands in a separate sprint).

Input parameters:

- `ailang_version` (string, required): The reporter's CLI version (free-form, used for triage)
- `auto_dispatch` (boolean): Authorize the receiving package's autonomous agent to act on this submission. Default false (files for human triage). Tagged on the Pub/Sub notification as category=auto:<original> for coordinator fi…
- `body` (string, required): Full description (≤10 KB)
- `category` (string, required): bug | feature | docs | limitation
- `contact` (string): Optional follow-up address (free-form, opaque to the server)
- `package` (string): Optional vendor/name (e.g. "sunholo/auth") to route to that package's pkg:vendor/name inbox. Empty = general AILANG feedback.
- `snippet` (string): Optional code/error snippet (≤4 KB)
- `title` (string, required): Short title for the report

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/sunholo-data-parse/docparse#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 62
- 2026-08-01: 61
- 2026-07-31: 61
- 2026-07-30: 59
- 2026-07-29: 59
- 2026-07-28: 58
- 2026-07-27: 57
- 2026-07-26: 57

## Links

- Remote endpoint: https://docparse.ailang.sunholo.com/mcp/
- Repository: https://github.com/sunholo-data/ailang-parse
- Website: https://www.sunholo.com/ailang-parse/
- Changelog RSS feed: https://verifymcp.io/servers/sunholo-data-parse/docparse/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sunholo-data-parse/docparse/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sunholo-data-parse/docparse