Loading…
14 PDF tools: merge, split, compress, watermark, encrypt, organize, metadata, and page extraction.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The stagenth-pdf-kit MCP server exposes 14 tools, focused primarily on general-purpose capabilities. Its published description reads: "14 PDF tools: merge, split, compress, watermark, encrypt, organize, metadata, and page extraction". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates stagenth-pdf-kit D+ — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Tool input schema requests a secret" and "Tool input schema requests a secret". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check stagenth-pdf-kit's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add stagenth-pdf-kit to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://stagenth.com/mcp/pdf-kit/Streamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
把多个 PDF 按顺序合并成一个文件（1 credit/次）。纯本地操作，失败自动退款。
抽取指定页另存为新 PDF（1 credit/次）。失败自动退款。
压缩 PDF 体积（清理冗余 + 重压缩流/图片/字体，1 credit/次）。失败自动退款。
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: pdf_encrypt
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: pdf_decrypt
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
执行，用户间数据隔离。提供工具：pdf_merge / pdf_split / pdf_compress / pdf_watermark / pdRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
AWS's official fully managed remote server that provides real-time access to comprehensive AWS documentation, API references, troubleshooting guides, and architectural guidance across multiple knowledge sources including What's New posts, Builder Center content, blog posts, and Well-Architected frameworks for building applications, managing infrastructure, and learning AWS services through natural language queries.
Search live events, conference weeks, host cities, venues, and artist tour schedules.
Live verifiable on-chain data for the $BOBAI token on BNB Chain.
Identity certification, public registry, reputation scoring, and x402 micropayments for AI agents built on Base and Solana.
Search 11M+ products across SG, SEA, and US. Agent-native catalog for AI shopping agents.
Scrapes web pages to clean Markdown with JS rendering, multi-page crawl, structured extraction, and sitemap support.
QR and barcode toolkit: generate, decode, vector SVG, logo QR, WiFi and vCard QR codes.
Turn Excel or CSV data into charts (bar, line, pie, scatter, radar) and get a download URL.
Image toolkit: resize, compress, crop, watermark, convert, rotate, and EXIF read/strip.
Secure file transfer MCP server that relays files between AI agents and downstream services using bearer-token authentication.
Hosted persistent memory with semantic search, importance scoring, and TTL for AI agents.
给每页加居中、45° 半透明文字水印（1 credit/次）。失败自动退款。
给 PDF 设打开密码（AES-256，1 credit/次）。失败自动退款。
图片格式转换 / 压缩（1 credit/次）。失败自动退款。
用已知密码解密 PDF、输出无密码版本（1 credit/次）。密码错误会报错并退款。
给每页居中贴一个半透明图片水印（1 credit/次）。失败自动退款。
把多张图片按顺序合成一个 PDF（每图一页，1 credit/次）。失败自动退款。
把 PDF 每页渲染成图片、打包成 ZIP（1 credit/次）。失败自动退款。
整理 PDF 页面：旋转指定页 / 删除指定页（1 credit/次，至少给一个操作）。失败自动退款。
给 PDF 每页加页码（可选前后缀）+ 可选页眉（1 credit/次，中英皆可）。失败自动退款。
读取或写入 PDF 元数据：不带写参数=返回标题/作者/页数等；带任一写参数=写入并返新 PDF。
按页码范围把 PDF 提取成新文件（如从 300 页报告抽出第 12-18 页），返下载 URL。