pdfnative-mcp: Instructions file for GitHub Copilot

Security Standards

Filesystem confinement

• All file writes must stay inside PDFNATIVE_MCP_OUTPUT_DIR.
• Reject:
  • absolute paths
  • .. path traversal
  • NUL byte paths
  • non-.pdf output extensions
• Use safe path resolution and canonicalization before writing.

Signing input handling

• Treat cert/key fields as sensitive input.
• Validate base64/hex strictly before use — decode through src/base64.ts (DER expected; PEM is rejected with a VALIDATION_ERROR + openssl remedy).
• Provide clear validation errors without leaking sensitive payload content.
• Never log or echo passwords, key/cert material, PDFNATIVE_MCP_TSA_AUTH or PDFNATIVE_MCP_HTTP_TOKEN.

Network and HTTP

• The only egress path is src/network.ts (operator-configured TSA / OCSP / CRL endpoints behind the SSRF guard); a tool argument never supplies a URL. A /URI written INTO a PDF (the link block) is data, not egress.
• HTTP mode (PDFNATIVE_MCP_PORT) binds loopback and checks Host/Origin (the Origin port must equal the server port — src/http.ts); PDFNATIVE_MCP_HTTP_TOKEN (src/auth.ts, ≥ 16 chars, constant-time compare, RFC 6750 challenge) is the only authentication — recommend it, and document that without it any local process can reach the endpoint.

Operator knobs

• Read once at boot, never from a tool argument; an invalid value refuses to start (silently falling back would leave the operator believing a protection is in force): PDFNATIVE_MCP_MAX_INFLATE_BYTES (src/inflate-cap.ts, zip-bomb cap), PDFNATIVE_MCP_CREATION_DATE / SOURCE_DATE_EPOCH (src/reproducible.ts, pinned creation instant — logged to stderr with its source).
• A new PDFNATIVE_MCP_* variable must be declared in server.json (tests/metadata.test.ts holds the two sets together).
• Images go through src/image.ts (magic bytes + PNG IHDR checks, 24 MiB per-call budget); embed_image.imageBase64 has no length bound (1.5.0 contract) — do not add one. ICC profiles go through decodeBase64Field and the engine's acsp / size checks.