PDF Reader MCP: why it is not safe to use

What we found

Our review found that PDF Reader MCP is local-first by default: it runs over stdio, does not require an API key, and we did not find hidden instructions, hardcoded secrets, privilege escalation behavior, or code aimed at unrelated credentials. We also did not see destructive commands such as delete, overwrite, or publish actions in the inspected runtime files.

The main concern is optional integrations. The skill can be configured to use OCR and visual analysis adapters that send document-derived data to a user-defined command or HTTP endpoint, including local model servers and OpenAI-compatible providers. We also found that installation typically relies on npm or npx to fetch the package and a platform-specific native dependency from npm. These behaviors are disclosed, but they introduce external network dependencies and may move PDF content outside a strictly local workflow when those options are enabled.

What to do instead

If you need the lowest data exposure path, keep use local-only: avoid optional OCR or visual adapters that call HTTP services, prefer local model servers you control, and review any configured endpoints before enabling them. If external processing is necessary, limit use to non-sensitive PDFs and document where content may be sent.