document-reader-mcp

The server explicitly states it is designed for local, trusted environments and has no built-in authentication. It processes local files using `os.path.expanduser`, which could lead to reading arbitrary files within the process's permissions if an untrusted client sends malicious paths. Document parsing libraries (pdfminer.six, openpyxl, python-docx, markitdown, PyMuPDF) are used, which inherently carry risks if malformed or malicious documents are processed (no internal sandboxing for these libraries). However, the project provides comprehensive security documentation (`SECURITY.md`), enforces a 100MB file size limit, implements rate limiting, and truncates output for AI context protection. The `convert_to_markdown` tool converts the *entire* document to a file, bypassing the output truncation for the AI's preview, which could consume significant local resources.