Loading…
MCP server for converting Markdown documents into professional DOCX, PDF, and HTML formats using custom or built-in designer templates.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The mdmagic-mcp-server MCP server exposes 10 tools, focused primarily on general-purpose capabilities. Its published description reads: "MCP server for converting Markdown documents into professional DOCX, PDF, and HTML formats using custom or built-in designer templates". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates mdmagic-mcp-server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check mdmagic-mcp-server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add mdmagic-mcp-server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.mdmagic.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Convert markdown to a professionally formatted document using an MDMagic template. IMPORTANT GUIDANCE: 1. Output format → what user gets: - 'docx' → a single Word .docx file - 'pdf' → a single .pdf fi
List all 15 built-in MDMagic templates plus any custom templates the user has uploaded. CALL THIS PROACTIVELY when: - The user mentions a template by name (verify it exists before convert_document) -
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: convert_document
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
"Base64 encoded file content (alternative to content or filePath)"},"fileNamRecommendationRemove side-channel parameters; constrain tool inputs.
tool: convert_document
A tool description tries to alter the model’s use of another tool.
d' errors: call list_all_templates first, show available options, let the user picRecommendationDescriptions must describe only their own tool.
tool: list_all_templates
A tool description tries to alter the model’s use of another tool.
t exists before convert_document) - The user asks 'what templates are available'RecommendationDescriptions must describe only their own tool.
tool: list_builtin_templates
A tool description tries to alter the model’s use of another tool.
tegory. Same as list_all_templates but excludes the user's custom uploads. Use thiRecommendationDescriptions must describe only their own tool.
tool: list_custom_templates
A tool description tries to alter the model’s use of another tool.
e, when calling convert_document.RecommendationDescriptions must describe only their own tool.
tool: show_default_settings
A tool description tries to alter the model’s use of another tool.
d of using A4/Portrait blindly.RecommendationDescriptions must describe only their own tool.
tool: check_credit_balance
A tool description tries to alter the model’s use of another tool.
lso returned by convert_document directly) - Before a conversion of an unusuallyRecommendationDescriptions must describe only their own tool.
tool: estimate_conversion_cost
A tool description tries to alter the model’s use of another tool.
their balance — convert_document refuses to run if credits are insufficient, soRecommendationDescriptions must describe only their own tool.
tool: get_template_details
A tool description tries to alter the model’s use of another tool.
variant before convert_document runs.RecommendationDescriptions must describe only their own tool.
tool: recommend_template
A tool description tries to alter the model’s use of another tool.
c's catalog, so convert_document doesn't fail with 'template not found'.RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: convert_document
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: convert_document
Role tokens or delimiter abuse steer the model rather than describe the tool.
nd code fences (```) ONLY work when each starts on its own line. WhRecommendationWrite neutral, descriptive tool metadata.
tool: list_all_templates
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_builtin_templates
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_custom_templates
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: show_default_settings
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: check_credit_balance
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_template_details
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
List the 15 built-in MDMagic templates, grouped by category. Same as list_all_templates but excludes the user's custom uploads. Use this when the user asks specifically about MDMagic's bundled templat
List only the user's custom-uploaded Word templates. Use this when the user asks about their own templates ('show me my templates', 'do I have a letterhead?'). Custom templates are referenced by UUID,
Show the user's default paper size and orientation preferences (set on their account page). Useful when the user hasn't specified pageSize/orientation explicitly — call this to honor their defaults in
Check the user's current MDMagic credit balance: subscription credits (renewable monthly), purchased credits (permanent), plan name, and plan status. CALL THIS PROACTIVELY when: - The user asks 'how m
Estimate credit cost for a conversion BEFORE running it. Returns word count, page calculation (300 words/page), and a credit breakdown by format and template type. Use this when the user asks 'how muc
Pre-flight markdown validation BEFORE conversion. Catches malformed tables (mismatched pipes), unclosed code fences, broken task lists, and unsupported syntax. Returns a green/amber/red status plus th
Show available variants (page sizes and orientations) for a specific template. All MDMagic templates support the full 5×2 matrix: A3, A4, Executive, US_Legal, US_Letter × Portrait/Landscape. Use this
Suggest the best built-in template(s) for a described purpose. Use this when the user describes WHAT the document is (e.g. 'Q4 board pack', 'API reference', 'wedding invitation', 'legal contract') wit