ai.filegraph/document-processing

B
7.0

Extract text from documents, manipulate PDFs, and perform OCR on images.

Installation

Security Report

Score Breakdown

Description10
Permissions10
Behavior4
Stability--

Findings (6)

high
vague-description

Vague capability description without tool visibility

The server claims to 'extract text from documents, manipulate PDFs, and perform OCR on images' but provides no tool definitions for verification. The term 'manipulate PDFs' is particularly broad and undefined—this could include arbitrary modifications, metadata injection, or other risky operations.

high
network-access

Remote HTTP endpoint without visible authentication

Server is exposed via remote HTTPS endpoint (https://api.filegraph.ai/mcp) using SSE transport. No authentication mechanism is documented. Remote servers are higher risk as they accept connections from the internet.

medium
excessive-scope

Broad scope for document processing server

The server claims three distinct capabilities (text extraction, PDF manipulation, OCR) which is reasonable for a document processor, but without tool definitions it's impossible to verify the actual scope or whether additional undocumented capabilities exist.

medium
vague-description

Tool count mismatch suggests incomplete metadata

Tool count shows 0 but the server clearly has capabilities (text extraction, PDF manipulation, OCR). This indicates either incomplete metadata fetching or the server's actual tool definitions were not retrieved, making security assessment incomplete.

low
info

Positive trust signal: public repository

Server has an associated GitHub repository (https://github.com/filegraph/docconvert), which allows for source code review and community scrutiny.

info
vague-description

Semantic Analysis Summary

This document processing server has moderate-to-high risk due to remote HTTP exposure without documented authentication, vague capability descriptions (especially 'manipulate PDFs'), and unavailable tool definitions that prevent proper security assessment. The public repository is a positive signal, but the incomplete metadata and broad scope claims warrant caution. Tool definitions should be reviewed before deployment.

Last scanned 1mo ago

Details

Version
1.0.1
Transport
sse
Capabilities