Security

We build pdfmcp assuming hostile input: people will send it weaponised PDFs, and the system is designed so that the worst case is a rejected file.

How uploads are defended

Transport limits — streamed size caps and per-key/per-IP rate limits during upload.
Identity check — magic bytes and MIME sniffing; a file must actually be what the operation expects.
Malware scan — every file is antivirus-scanned before processing; if the scanner is down, intake refuses work (fail-closed).
Structural validation — a full parser check rejects corrupt or deliberately malformed documents.
Active-content scan — embedded executables and launch actions are rejected outright; scripts and external references are rejected where an operation doesn't need them.
Resource-bomb checks — page-count, expansion-ratio, nesting-depth and image-dimension caps kill decompression bombs before they reach a worker.
Sandboxed processing — workers are non-root, read-only, capability-dropped containers with CPU/RAM/time limits and no internet access. Only the front proxy publishes ports (80/443).

Rejections are machine-readable: {"error": "rejected_by_security_module", "reason": "<code>"}, identical on REST and MCP. Account security: passwordless sign-in (single-use 6-digit codes, hashed at rest), API keys stored only as salted hashes, emails encrypted at rest.

Report a vulnerability

We welcome good-faith research. Email hello@pdfmcp.org with “SECURITY” in the subject: tell us what you found, how to reproduce it, and the impact you believe it has. Please don't access other users' data, don't degrade the service, and give us a reasonable window to fix before disclosing publicly. We don't run a paid bounty — we're a free service — but we credit reporters (with permission) and we fix fast.

security.txt

Contact: mailto:hello@pdfmcp.org
Expires: 2027-11-11T00:00:00.000Z
Preferred-Languages: en
Canonical: https://pdfmcp.org/.well-known/security.txt
Policy: https://pdfmcp.org/security/

Also served at /.well-known/security.txt.