Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/nizoka/pdfnative-mcp/securitygit clone --depth 1 https://github.com/Nizoka/pdfnative-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00489 | $0.00489 |
| Opus 5 | $0.00244 | $0.00244 |
| Sonnet 5 | $0.00098 | $0.00098 |
| Haiku 4.5 | $0.00049 | $0.00049 |
Grade A, and why
pdfnative-mcp security.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Security Standards
Filesystem confinement
- All file writes must stay inside PDFNATIVE_MCP_OUTPUT_DIR.
- Reject:
- absolute paths
- .. path traversal
- NUL byte paths
- non-.pdf output extensions
- Use safe path resolution and canonicalization before writing.
Signing input handling
- Treat cert/key fields as sensitive input.
- Validate base64/hex strictly before use — decode through
src/base64.ts(DER expected; PEM is rejected with aVALIDATION_ERROR+ openssl remedy). - Provide clear validation errors without leaking sensitive payload content.
- Never log or echo passwords, key/cert material,
PDFNATIVE_MCP_TSA_AUTHorPDFNATIVE_MCP_HTTP_TOKEN.
Network and HTTP
- The only egress path is
src/network.ts(operator-configured TSA / OCSP / CRL endpoints behind the SSRF guard); a tool argument never supplies a URL. - HTTP mode (
PDFNATIVE_MCP_PORT) binds loopback and checks Host/Origin (the Origin port must equal the server port —src/http.ts);PDFNATIVE_MCP_HTTP_TOKEN(src/auth.ts, ≥ 16 chars, constant-time compare, RFC 6750 challenge) is the only authentication — recommend it, and document that without it any local process can reach the endpoint. PDFNATIVE_MCP_MAX_INFLATE_BYTES(src/inflate-cap.ts) is read once at boot and applied to the engine's zip-bomb cap; an invalid value must refuse to start. Tool arguments can never change it.- Images go through
src/image.ts(magic bytes + PNG IHDR checks, 24 MiB per-call budget);embed_image.imageBase64has no length bound (1.5.0 contract) — do not add one.
Dependency and CI security
- Exactly three runtime dependencies (pdfnative,
@modelcontextprotocol/server, zod); adding one is a governance blocker. - npm publish via OIDC Trusted Publishing only.
- Keep lockfile committed and audit in CI.
- Run CodeQL and Scorecard workflows.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 33 lines · 489 tokens per session scan A 1ead797be1b2
pdfnative-mcp security.instructions.md is an instructions file published in the GitHub repository Nizoka/pdfnative-mcp (2 stars, last pushed 8d ago), licensed MIT. It adds 489 tokens to every session, about $0.0024 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
docs-to-pdf CLAUDE.md
Instructions for jean-humann/docs-to-pdf, covering claude development guide for docs-to-pdf, project overview, development environment setup, using mise (recommended) and install mise (if not already installed).
Portwood CLAUDE.md
Instructions for Portwood-Global-Solutions/Portwood, covering claude.md — portwood, skills, how this project runs (from 2026-08-10), release cadence and triage.
prfaq CLAUDE.md
Instructions for punt-labs/prfaq, covering how i write code, mandatory reading, no "pre-existing" excuse, standards and development workflow.
nutrient-dws-client-typescript AGENTS.md
Instructions for PSPDFKit-labs/nutrient-dws-client-typescript, covering agents.md, rules, definition of done and where to look.
nutrient-dws-client-typescript CLAUDE.md
Instructions for PSPDFKit-labs/nutrient-dws-client-typescript: Canonical agent instructions live in @AGENTS.md — read it first.
jsignpdf AGENTS.md
AGENTS.md instructions for intoolswetrust/jsignpdf, covering agents.md - jsignpdf, project overview, build commands, module structure and key documentation artifacts.