
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@hushvert/mcp
Advanced tools
Model Context Protocol server for hushvert: gives an AI agent a convert_file tool over the hosted file-conversion API (office to PDF, PDF to Word, large video). Pairs a browser cannot do, billed per use.

A file-conversion tool for your AI agent.
@hushvert/mcp is a Model Context Protocol
server that gives an AI coding agent (Claude Code, Cursor, Cline, Zed, and any
other MCP host) a convert_file tool over the hushvert hosted API. When a task
needs a conversion a browser cannot do - office documents to PDF, PDF to Word,
large video transcodes - the agent converts the file in one tool call, and the
result is written next to the input. No upload code, no polling, no glue.
It is a thin client over the hushvert hosted API. For the
conversions that DO run in a browser (images, HEIC, archives, audio, small video,
PDF page ops), use the free, open-source @hushvert/engine
package instead - this server will refuse those and point you there.
A real run in Claude Code, recorded live and not sped up: ask, and report.pdf is
written next to the input. The whole turn took 23 seconds, of which the conversion
itself was about 7.

The recording starts Claude Code with only this server loaded
(--strict-mcp-config) so nothing unrelated is on screen. The tape that produced
it is assets/demo.tape,
if you want to reproduce it.
Because it can only convert what your machine can convert, and when it cannot, it does not fail loudly.
Ask any coding agent to turn report.docx into a PDF. If LibreOffice is
installed, it will shell out to soffice, do a good job, and you do not need this
server. If LibreOffice is not installed, and it is not there by default on macOS,
on Windows, or in a typical CI image, the usual fallback is pandoc. Pandoc does
not really convert a Word document. It reads the text into its own AST, hands that
to LaTeX, and LaTeX typesets a new document. You get a PDF. The agent reports
success. Nobody opens the file.
Here is the same report.docx down both paths:

Same words, different document. Every font in the pandoc PDF is Latin Modern,
LaTeX's default. The heading color is gone, the table lost its Word styling, and
the title moved into a centered LaTeX title block. pdffonts on the two outputs:
pandoc LMRoman17-Regular, LMRoman12-Bold, LMRoman10-Italic, ...
hushvert Carlito-Regular, Carlito-Bold, Carlito-Italic
Carlito is metric-compatible with Calibri, which is what the document actually asked for. Latin Modern is not.
So, honestly:
convert_file once and pandoc the other time, and the two runs
produced the two documents above. Which tool an agent reaches for is its call,
not ours. "Convert report.docx to PDF with hushvert" pins it.Get an API key at hushvert.com/developers/keys (sign-in is a one-time email code; keys require a confirmed email), then add the server to your agent's MCP config.
Claude Code - one line, no file to edit:
claude mcp add hushvert -e HUSHVERT_API_KEY=hv_live_your_key_here -- npx -y @hushvert/mcp
Cursor, Cline, Zed, and other MCP hosts (or Claude Code, if you prefer a
committed project config) - add this block to the host's MCP config
(.mcp.json, .cursor/mcp.json, and so on):
{
"mcpServers": {
"hushvert": {
"command": "npx",
"args": ["-y", "@hushvert/mcp"],
"env": { "HUSHVERT_API_KEY": "hv_live_your_key_here" }
}
}
}
If that file is committed, do not put the key in it. Claude Code expands
environment variables in an MCP config, so use "HUSHVERT_API_KEY": "${HUSHVERT_API_KEY}" and keep the real key in your shell. Other hosts vary;
check yours before committing.
Then ask your agent: "convert report.docx to PDF with hushvert." Naming the server is worth the two extra words: if your machine has a local converter, the agent may reach for that instead, and for office documents the result is usually worse. See above.
| Tool | What it does |
|---|---|
convert_file | Convert a local file to another format. Reads the input, runs the conversion, writes the output, returns the path. |
convert_poll | Finish a long conversion (large video) that was still running when convert_file returned. |
list_formats | List the conversions the hosted API supports (the server-only pairs). |
check_usage | Show free conversions remaining, credit balance, and the current billing window. |
convert_fileinput_path (required) path to the source file
to (required) target format, e.g. "pdf", "docx", "mp4"
from (optional) source format; inferred from the extension otherwise
output_path (optional) where to write; defaults beside the input. Required to overwrite.
wait_seconds (optional) max seconds to wait before handing back a jobId to poll. Default 120.
idempotency_key (optional) makes a retried conversion safe (same job, charged once)
Returns { output_path, jobId, pair, bytesIn, bytesOut, status }. If the job is
still running after wait_seconds (typical for large video), it returns
{ jobId, status: "processing", resumeWith: "convert_poll" }; call convert_poll
with the jobId and an output_path to finish.
The server-only formats a browser cannot do:
Call list_formats for the live list. Everything else (images, HEIC, archives,
audio, small video, PDF page ops) runs free, client-side, in
@hushvert/engine.
| Env var | Default | Purpose |
|---|---|---|
HUSHVERT_API_KEY | (required) | Your hv_live_ developer key. |
HUSHVERT_API_BASE | https://hushvert.com | API base URL (for self-host / staging). |
HUSHVERT_DEFAULT_WAIT_SECONDS | 120 | Default poll budget for convert_file. |
HUSHVERT_MAX_JOBS_PER_SESSION | unlimited | Client-side cap on conversions per server run (a guard against runaway loops). |
HUSHVERT_ALLOWED_DIR | unset | If set, the server only reads/writes files under this directory. |
Conversions are billed per use against your account: a free monthly allowance,
then credits. check_usage shows your remaining allowance and balance at any
time - have your agent check it before a large batch. The hosted API processes
the server-only formats that genuinely cannot run in a browser; for everything
else the file never leaves the device via the open-source engine. See
hushvert.com/for-developers.
The API key is read from the environment, never logged, and never returned in a tool result or error. See SECURITY.md.
MIT
FAQs
Model Context Protocol server for hushvert: gives an AI agent a convert_file tool over the hosted file-conversion API (office to PDF, PDF to Word, large video). Pairs a browser cannot do, billed per use.
We found that @hushvert/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.