io.github.jztan/pdf-mcp

The listed variables, PDF_MCP_CACHE_DIR and PDF_MCP_CACHE_TTL, appear to be local cache path and TTL settings rather than API keys or account credentials; no clear credential leakage or abuse risk is shown in the materials.

No remote endpoint is declared, and the materials do not describe uploading PDFs or connecting to third-party services; based on the available facts, there is no evidence of user data being sent externally.

The system checks indicate code/process execution. For an MCP tool this is a normal capability, but it still means running a local service and processing PDFs, so its parser libraries, subprocess behavior, and runtime privileges should be reviewed.

As a PDF-processing service, it is expected to read user-provided PDFs and write local cache data under PDF_MCP_CACHE_DIR; this is consistent with its stated function, and the materials do not show signs of excessive access beyond that purpose.

Positive signals include the official registry source, auditable open-source repository, and updates within the last year; however, the README is minimal, the license is unspecified, and community adoption is currently low (0 stars), so supply-chain transparency is moderate and dependency/release consistency should be checked before deployment.