PaperlessMCP: why it is not safe to use
PaperlessMCP mainly matched its stated purpose, but it reads a Paperless API token from env vars and can upload local files by absolute path.
What we found
Our review of PaperlessMCP did not find hidden instructions, hardcoded secrets, obfuscated code, undeclared external fetches, or privilege escalation behavior in the inspected repository. The code and documentation indicate it connects to a user-configured Paperless-ngx instance, and destructive or bulk document actions are guarded with `confirm=true` and dry-run defaults.
The main reason for our warning is scope of access. The skill reads a Paperless API token from environment variables, and it can read local files by absolute path in order to upload them to the configured Paperless instance. For some users, especially non-technical users, that local file access may be broader than expected if the skill is given access on a machine with sensitive files.
What to do instead
Use this skill only if you are comfortable granting it access to a Paperless API token and to specific local files for upload. Prefer running it in a constrained environment, such as a dedicated container or account, with access limited to the folders you intend to use. Use a scoped Paperless token where possible, avoid storing unrelated sensitive files in reachable paths, and review any absolute file paths before upload.
Source: https://github.com/barryw/PaperlessMCP
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.