pdfkb-mcp@0.7.0
VERIFIED· not startedPublisher claims: "A Model Context Protocol server for managing PDF documents with vector search capabilities" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
HF_TOKENOPENAI_API_KEYOPENROUTER_API_KEYPDFKB_DEEPINFRA_API_KEYPDFKB_HUGGINGFACE_API_KEYPDFKB_OPENAI_API_KEYPDFKB_OPENROUTER_API_KEYPDFKB_SUMMARIZER_API_KEYConfiguration, not credentials: CACHE_DIR, CHUNK_OVERLAP, CHUNK_SIZE, DOCLING_DEVICE, DOCLING_FORMULA_ENRICHMENT, DOCLING_MAX_PAGES, DOCLING_OCR_ENGINE, DOCLING_OCR_LANGUAGES, DOCLING_PROCESSING_TIMEOUT, DOCLING_TABLE_MODE, EMBEDDING_BATCH_SIZE, EMBEDDING_MODEL, FILE_SCAN_INTERVAL, KNOWLEDGEBASE_PATH, MARKER_LLM_MODEL, MARKER_USE_LLM, MINERU_LANG, MINERU_METHOD, MINERU_VRAM, PDF_CHUNKER, PDF_PARSER, PDF_PROCESSING_STRATEGY, PDFKB_BACKGROUND_QUEUE_WORKERS, PDFKB_CACHE_DIR, PDFKB_CHUNK_OVERLAP, PDFKB_CHUNK_SIZE, PDFKB_DEEPINFRA_RERANKER_MODEL, PDFKB_DOCLING_DEVICE, PDFKB_DOCLING_FORMULA_ENRICHMENT, PDFKB_DOCLING_MAX_PAGES, PDFKB_DOCLING_OCR_ENGINE, PDFKB_DOCLING_OCR_LANGUAGES- Where it talks to
- no vendor host named in the codeAlso openrouter.ai, deepinfra.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names openrouter.ai, deepinfra.com as well as its own vendor. The guard injects HF_TOKEN, OPENAI_API_KEY, OPENROUTER_API_KEY, PDFKB_DEEPINFRA_API_KEY, PDFKB_HUGGINGFACE_API_KEY, PDFKB_OPENAI_API_KEY, PDFKB_OPENROUTER_API_KEY, PDFKB_SUMMARIZER_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationsStatic findings
Automatically loads from .env file if it exists in the current directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.await self.mcp_server.app.run_http_async(Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.# Load .env file if it existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.console.log('FileUpload component initialized');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.potential_env = path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.# Look for .env file in current directory and parent directoriesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.result = subprocess.run(["mineru", "--version"], capture_output=True, text=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for pdfkb-mcp@0.7.0 as of 55 min ago. This is the package itself, not its dependencies.