
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@truepathpdf/mcp-server
Advanced tools
Local-only MCP server for TruePath PDF — let your AI process PDFs on your Mac, files never leave your machine.
Let your AI process PDFs locally. Files never leave your Mac.
@truepathpdf/mcp-server is a Model Context Protocol server that lets Claude, Cursor, and any other MCP-aware client read and process PDF files on your machine — without uploading them anywhere.
Built and maintained by Joy Truepath Pte. Ltd., the team behind the TruePath PDF Mac app.
v0.3 — free tier complete (9 of 9 tools). Read + edit + rasterise + GUI handoff: get_info, extract_text, search, split, merge, pages, to_images, extract_images, open_in_truepath. The full Pro tier (redact, fill_form, flatten, sign, compress, annotate, autocrop, batch, ocr) lands behind an Ed25519 license key in v0.4.
open_in_truepath requires the TruePath PDF Mac app v1.0.1 or newer (the truepath:// handler is added in 1.0.1; the v1.0.0 build does not register it).
# npx — no install required
npx -y @truepathpdf/mcp-server
# or install globally
npm install -g @truepathpdf/mcp-server
truepath-pdf-mcp
Requires Node.js 20 or newer.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"truepath-pdf": {
"command": "npx",
"args": ["-y", "@truepathpdf/mcp-server"]
}
}
}
Restart Claude Desktop. The truepath-pdf tools appear in the tool tray.
get_infoPage count, first-page size (with an allSameSize flag), encryption status, and embedded PDF metadata (title, author, dates, producer, format version).
{ "path": "/Users/you/Documents/report.pdf" }
extract_textPlain-text extraction. Optional 1-based page range ("3", "1-5", "1,3,5-7"). Output is grouped by page with ===== Page N ===== markers so the model can cite the right page.
{ "path": "/Users/you/Documents/report.pdf", "pages": "1-3" }
searchSubstring search across the whole document. Returns each hit's page, offset within the page, and a snippet of surrounding text. Use for grep-style discovery before a heavier extract_text.
{ "path": "/Users/you/Documents/report.pdf", "query": "revenue", "contextChars": 80 }
splitSplit one PDF into N by page ranges. Each range becomes one output file.
{ "path": "/in.pdf", "ranges": ["1-3", "4-7", "8"], "outputDir": "/out" }
mergeCombine two or more PDFs into one, in the given order.
{ "paths": ["/a.pdf", "/b.pdf", "/c.pdf"], "outputPath": "/out/merged.pdf" }
pagesDelete, rotate, and reorder pages in one pass. delete is applied first (page numbers in rotate refer to the source PDF); reorder is applied to the survivors.
{
"path": "/in.pdf",
"outputPath": "/out/edited.pdf",
"delete": "2,5",
"rotate": [{ "page": 1, "degrees": 90 }],
"reorder": [3, 1, 2]
}
to_imagesRasterise PDF pages as PNG or JPG at a chosen DPI. Common DPIs: 96 (screen), 150 (print preview), 300 (print).
{ "path": "/in.pdf", "outputDir": "/out", "pages": "1-5", "dpi": 150, "format": "png" }
extract_imagesPull embedded images out of a PDF and write each as a PNG. Reports any images skipped because of unsupported pixel layouts (CMYK, palettized, etc).
{ "path": "/in.pdf", "outputDir": "/out" }
open_in_truepathHand a local PDF to the TruePath PDF Mac app via truepath://open?path=…. Fire-and-forget: macOS launches (or routes to) the app, the URL handler opens the PDF. Use this after reading / analyzing in MCP to drop the user into the GUI for annotation, signing, redaction, etc.
{ "path": "/Users/you/Documents/report.pdf" }
Optional scheme param for re-branded engine builds (default truepath; the Yochen core build uses yochenpdf).
redact — text-preserving redaction via PDFium (the same engine the Mac app uses; the words are removed from the file, not just covered)fill_form — fill AcroForm fields, save with values preservedflatten — bake filled forms / annotations into the page streamsign — visible signature placement, signed-PDF writecompress — recompress images / streams to shrink file sizeannotate — programmatic highlight / underline / sticky-noteautocrop — detect content bounds and crop marginsbatch — apply any tool across a glob of filesocr — Apple Vision OCR (Mac only, on-device, CJK-strong)A buy-once Pro key will be available via Lemon Squeezy at launch (target: USD 29, includes 12 months of updates). Owners of the TruePath PDF Mac app will be able to redeem their App Store receipt for a Pro MCP key via an in-app button.
MIT for the MCP shell. Transitive dependencies:
@modelcontextprotocol/sdk — MITpdfjs-dist — Apache 2.0pdf-lib — MIT@napi-rs/canvas — MITzod — MITPro tier will additionally bundle a prebuilt PDFium library (BSD/Apache, the same one used by Chrome).
FAQs
Local-only MCP server for TruePath PDF — let your AI process PDFs on your Mac, files never leave your machine.
The npm package @truepathpdf/mcp-server receives a total of 32 weekly downloads. As such, @truepathpdf/mcp-server popularity was classified as not popular.
We found that @truepathpdf/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.