pdf-to-markdown-mcp 1.0.7 → 1.0.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/.vscode/settings.json +7 -6
  2. package/README.md +4 -3
  3. package/dist/src/index.js +14 -1
  4. package/dist/src/index.js.map +1 -1
  5. package/package.json +4 -3
  6. package/src/index.ts +19 -1
package/.vscode/settings.json CHANGED
@@ -1,10 +1,11 @@
1
1
  {
2
2
  "chat.instructionsFilesLocations": {
3
3
  ".github/instructions": true,
4
- "C:\\Users\\YXZHK\\source\\explore\\awesome-copilot\\instructions\\markdown.instructions.md": true,
5
- "C:\\Users\\YXZHK\\source\\explore\\awesome-copilot\\instructions\\security-and-owasp.instructions.md": true,
6
- "C:\\Users\\YXZHK\\source\\explore\\awesome-copilot\\instructions\\self-explanatory-code-commenting.instructions.md": true,
7
- "C:\\Users\\YXZHK\\source\\explore\\awesome-copilot\\instructions\\typescript-mcp-server.instructions.md": true,
8
- "C:\\Users\\YXZHK\\source\\explore\\awesome-copilot\\instructions\\typescript-5-es2022.instructions.md": true,
9
- },
4
+ "~/source/explore/awesome-copilot/instructions/markdown.instructions.md": true,
5
+ "~/source/explore/awesome-copilot/instructions/security-and-owasp.instructions.md": true,
6
+ "~/source/explore/awesome-copilot/instructions/self-explanatory-code-commenting.instructions.md": true,
7
+ "~/source/explore/awesome-copilot/instructions/typescript-mcp-server.instructions.md": true,
8
+ "~/source/explore/awesome-copilot/instructions/typescript-5-es2022.instructions.md": true,
9
+ "~/source/explore/awesome-copilot/instructions/update-docs-on-code-change.instructions.md": true,
10
+ }
10
11
  }
package/README.md CHANGED
@@ -3,7 +3,7 @@
3
3
  [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
4
4
  [![Node.js](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen.svg)](https://nodejs.org/)
5
5
  [![TypeScript](https://img.shields.io/badge/TypeScript-5.7-blue.svg)](https://www.typescriptlang.org/)
6
- [![MCP](https://img.shields.io/badge/MCP-1.25.2-purple.svg)](https://modelcontextprotocol.io/)
6
+ [![MCP](https://img.shields.io/badge/MCP-1.27.1-purple.svg)](https://modelcontextprotocol.io/)
7
7
 
8
8
  A Model Context Protocol (MCP) server that converts PDF pages to markdown format using the Qwen VL vision model.
9
9
 
@@ -28,7 +28,8 @@ npm run build
28
28
  The server needs the following environment variables:
29
29
  - `QWEN_API_URL`: The endpoint URL (e.g., `https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions`)
30
30
  - `QWEN_API_KEY`: Your authentication key.
31
- - `QWEN_MODEL`: The specific model name (defaults to `qwen-vl-max`).
31
+ - `QWEN_MODEL`: The specific model name (defaults to `Qwen3-VL-235B-A22B-Instruct`).
32
+ - `WORKSPACE` (optional): Comma-separated list of absolute directory paths. When set, the server will only process PDF files located within these directories, preventing access to files outside the allowed workspace.
32
33
 
33
34
  ### 3. Setup with Claude Desktop
34
35
  Add this to your Claude Desktop configuration file:
@@ -45,7 +46,7 @@ Add this to your Claude Desktop configuration file:
45
46
  "env": {
46
47
  "QWEN_API_URL": "https://your-qwen-api-endpoint.com/v1/chat/completions",
47
48
  "QWEN_API_KEY": "your-api-key-here",
48
- "QWEN_MODEL": "qwen-vl-max"
49
+ "QWEN_MODEL": "Qwen3-VL-235B-A22B-Instruct"
49
50
  }
50
51
  }
51
52
  }
package/dist/src/index.js CHANGED
@@ -2,6 +2,7 @@
2
2
  import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
3
3
  import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
4
4
  import * as fs from "node:fs/promises";
5
+ import * as path from "node:path";
5
6
  import { z } from "zod";
6
7
  import { convertPdfPageToImage } from "./pdfConverter.js";
7
8
  /**
@@ -61,7 +62,7 @@ async function main() {
61
62
  if (!apiUrl || !apiKey) {
62
63
  throw new Error("Missing required environment variables: QWEN_API_URL and QWEN_API_KEY must be set");
63
64
  }
64
- const se = "1.0.7";
65
+ const se = "1.0.9";
65
66
  const server = new McpServer({
66
67
  name: "pdf-to-markdown-mcp",
67
68
  version: se,
@@ -85,6 +86,18 @@ async function main() {
85
86
  !Number.isInteger(page_number)) {
86
87
  throw new Error("page_number must be a positive integer");
87
88
  }
89
+ // Validate pdf_path is within an allowed workspace directory
90
+ const workspaceEnv = process.env.WORKSPACE;
91
+ if (workspaceEnv) {
92
+ const allowedDirs = workspaceEnv
93
+ .split(",")
94
+ .map((d) => path.resolve(d.trim()));
95
+ const resolvedPdfPath = path.resolve(pdf_path);
96
+ const isAllowed = allowedDirs.some((dir) => resolvedPdfPath.startsWith(dir + path.sep) || resolvedPdfPath === dir);
97
+ if (!isAllowed) {
98
+ throw new Error(`Access denied: pdf_path must be located within one of the allowed workspace directories`);
99
+ }
100
+ }
88
101
  // Check if file exists
89
102
  try {
90
103
  await fs.access(pdf_path);
package/dist/src/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAc1D;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,WAAmB,EACnB,MAAc,EACd,MAAc,EACd,SAAiB;IAEjB,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,WAAW;wBACjB,SAAS,EAAE;4BACT,GAAG,EAAE,yBAAyB,WAAW,EAAE;yBAC5C;qBACF;oBACD;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,mGAAmG;qBAC1G;iBACF;aACF;SACF;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,MAAM,EAAE;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;IAEzD,6CAA6C;IAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,6BAA6B,CAAC;IAE1E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC;IACnB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,CAAC,YAAY,CACjB,8BAA8B,EAC9B;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,4MAA4M;QAC9M,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC3B,gFAAgF,CACjF;YACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC9B,iGAAiG,CAClG;SACF;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YAED,IACE,OAAO,WAAW,KAAK,QAAQ;gBAC/B,WAAW,GAAG,CAAC;gBACf,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,4BAA4B;YAC5B,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEvE,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,WAAW,EACX,MAAM,EACN,MAAM,EACN,SAAS,CACV,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;qBACf;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,0CAA0C,YAAY,EAAE;qBAC/D;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,mBAAmB;IACnB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,oBAAoB,CAAC,CAAC;AACxE,CAAC;AAED,IAAI,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAc1D;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,WAAmB,EACnB,MAAc,EACd,MAAc,EACd,SAAiB;IAEjB,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,WAAW;wBACjB,SAAS,EAAE;4BACT,GAAG,EAAE,yBAAyB,WAAW,EAAE;yBAC5C;qBACF;oBACD;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,mGAAmG;qBAC1G;iBACF;aACF;SACF;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,MAAM,EAAE;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;IAEzD,6CAA6C;IAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,6BAA6B,CAAC;IAE1E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC;IACnB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,CAAC,YAAY,CACjB,8BAA8B,EAC9B;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,4MAA4M;QAC9M,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC3B,gFAAgF,CACjF;YACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC9B,iGAAiG,CAClG;SACF;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YAED,IACE,OAAO,WAAW,KAAK,QAAQ;gBAC/B,WAAW,GAAG,CAAC;gBACf,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YAED,6DAA6D;YAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,WAAW,GAAG,YAAY;qBAC7B,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACzC,eAAe,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,KAAK,GAAG,CACtE,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,4BAA4B;YAC5B,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEvE,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,WAAW,EACX,MAAM,EACN,MAAM,EACN,SAAS,CACV,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;qBACf;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,0CAA0C,YAAY,EAAE;qBAC/D;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,mBAAmB;IACnB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,oBAAoB,CAAC,CAAC;AACxE,CAAC;AAED,IAAI,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pdf-to-markdown-mcp",
3
- "version": "1.0.7",
3
+ "version": "1.0.9",
4
4
  "description": "MCP server that converts PDF pages to markdown using Qwen VL model",
5
5
  "type": "module",
6
6
  "main": "dist/src/index.js",
@@ -26,12 +26,13 @@
26
26
  "author": "",
27
27
  "license": "MIT",
28
28
  "dependencies": {
29
- "@modelcontextprotocol/sdk": "^1.25.2",
29
+ "@modelcontextprotocol/sdk": "^1.27.1",
30
30
  "canvas": "3.2.0",
31
31
  "pdfjs-dist": "4.8.69"
32
32
  },
33
33
  "overrides": {
34
- "hono":"4.11.4"
34
+ "hono":"4.12.5",
35
+ "ajv":"8.18.0"
35
36
  },
36
37
  "devDependencies": {
37
38
  "@types/node": "^22.10.2",
package/src/index.ts CHANGED
@@ -3,6 +3,7 @@
3
3
  import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
4
4
  import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
5
5
  import * as fs from "node:fs/promises";
6
+ import * as path from "node:path";
6
7
  import { z } from "zod";
7
8
  import { convertPdfPageToImage } from "./pdfConverter.js";
8
9
 
@@ -96,7 +97,7 @@ async function main() {
96
97
  );
97
98
  }
98
99
 
99
- const se = "1.0.7";
100
+ const se = "1.0.9";
100
101
  const server = new McpServer({
101
102
  name: "pdf-to-markdown-mcp",
102
103
  version: se,
@@ -133,6 +134,23 @@ async function main() {
133
134
  throw new Error("page_number must be a positive integer");
134
135
  }
135
136
 
137
+ // Validate pdf_path is within an allowed workspace directory
138
+ const workspaceEnv = process.env.WORKSPACE;
139
+ if (workspaceEnv) {
140
+ const allowedDirs = workspaceEnv
141
+ .split(",")
142
+ .map((d) => path.resolve(d.trim()));
143
+ const resolvedPdfPath = path.resolve(pdf_path);
144
+ const isAllowed = allowedDirs.some((dir) =>
145
+ resolvedPdfPath.startsWith(dir + path.sep) || resolvedPdfPath === dir
146
+ );
147
+ if (!isAllowed) {
148
+ throw new Error(
149
+ `Access denied: pdf_path must be located within one of the allowed workspace directories`
150
+ );
151
+ }
152
+ }
153
+
136
154
  // Check if file exists
137
155
  try {
138
156
  await fs.access(pdf_path);