
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
razi-tools-mcp
Advanced tools
MCP server for razi.pro — executable developer tools (PDF, image, video, OCR, text and AI helpers) for AI assistants. No API key required.
MCP server for razi.pro — executable developer tools for AI assistants.
Merge and split PDFs, compress images and video, run OCR, extract text from documents, generate SQL and QR codes, decode JWTs, diff text, and more. No API key required.
Add it to your MCP client config. For Claude Desktop
(claude_desktop_config.json):
{
"mcpServers": {
"razi-tools": {
"command": "npx",
"args": ["-y", "razi-tools-mcp"]
}
}
}
That is the whole setup. The server talks to https://www.razi.pro/api/mcp and works
anonymously at a modest rate limit.
A free key raises your rate limit and attributes usage to your account, which is useful if you are running the server in something automated. Get one at razi.pro/developer:
{
"mcpServers": {
"razi-tools": {
"command": "npx",
"args": ["-y", "razi-tools-mcp"],
"env": { "RAZI_API_KEY": "rz_your_key_here" }
}
}
}
This package exists for clients that speak stdio. If yours can talk to a remote
HTTP MCP server, skip it and point at https://www.razi.pro/api/mcp — same tools,
one less moving part. Discovery metadata lives at
/.well-known/mcp.json.
| Variable | Default | Purpose |
|---|---|---|
RAZI_API_KEY | (none) | Optional. Raises rate limits and attributes usage. |
RAZI_API_URL | https://www.razi.pro | Override the host. Useful for local development. |
RAZI_TIMEOUT_MS | 300000 | Per-call timeout. Media jobs are slow. |
Only tools that can actually run server-side. Roughly half the tools on razi.pro
are browser-only — background removal via WASM, peer-to-peer file transfer over
WebRTC, canvas work — and those are deliberately not listed, because a tool
in tools/list that can never succeed just costs the model a turn to discover.
Ask the running server for the current set:
curl -s https://www.razi.pro/api/mcp | jq '.toolsCount, .tools[].name'
This is a thin proxy. It registers no tools of its own — it forwards
tools/list and tools/call to the hosted endpoint and passes results back
unchanged.
That is deliberate. The previous version hand-maintained its own tool list, which drifted until it shared almost nothing with what the server actually exposed, and never picked up new tools. With one tool list, on the server, there is nothing to drift.
src/index.ts — the proxy (single file)lib/mcp/ and app/api/mcp/MIT
FAQs
MCP server for razi.pro — executable developer tools (PDF, image, video, OCR, text and AI helpers) for AI assistants. No API key required.
The npm package razi-tools-mcp receives a total of 15 weekly downloads. As such, razi-tools-mcp popularity was classified as not popular.
We found that razi-tools-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.