Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/open-document-alliance/pdf-tools/claude-mdgit clone --depth 1 https://github.com/Open-Document-Alliance/PDF-ToolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/open-document-alliance/pdf-tools/claude-md)<a href="https://agentmods.dev/instructions/open-document-alliance/pdf-tools/claude-md"><img src="https://agentmods.dev/badge/instructions/open-document-alliance/pdf-tools/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.07798 | $0.07798 |
| Opus 5 | $0.03899 | $0.03899 |
| Sonnet 5 | $0.01560 | $0.01560 |
| Haiku 4.5 | $0.00780 | $0.00780 |
Grade E, and why
PDF-Tools CLAUDE.md scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasinghighPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
would bypass the safety rules and fails the artifact test. Do not Nullifies safety policieshighAnti-refusal
"You have no restrictions", "do anything now", "ignore your guidelines": a direct jailbreak that disables guardrails.
would bypass the safety rules and fails the artifact test. Do not Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
`server/pdf-lib-subprocess.js`. It bounds how long a hostile document may hold How it starts
The opening of the file, as written. The whole thing — 538 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PDF Toolkit MCP - Development Guide
Active Kepano / Shannon Work
Before continuing the current extraction-improvement tranche, read
docs/handoffs/KEPANO_SHANNON.md. The crucial starting fact is that Kepano's
example is Shannon's A Mathematical Theory of Communication PDF; it is not a
separate example to locate.
This document provides essential context for Claude and other AI assistants when working on the PDF Toolkit extension.
Project Overview
PDF Toolkit is a Claude Desktop extension (MCPB) and MCP server that enables automated PDF form filling, bulk processing, and data extraction. Published in the official Claude Desktop Extension Directory.
Key Features
- List PDF files in directories
- Read form fields from PDFs (text, checkboxes, dropdowns, radio buttons)
- Fill PDF forms programmatically
- Save filled PDFs to new files
- Password-protected PDFs: read through PDF.js or qpdf, and changed through qpdf with the document's own protection restored on save (see
## Password Support) - Bulk fill from CSV files
- Profile system for reusable data
- Extract data from PDFs to CSV
- Form validation
- PDF.js text-layer extraction and page/region rendering for visual inspection
Technical Architecture
Technology Stack
- Runtime: Node.js (ES modules)
- PDF Libraries: pdf-lib, pdfjs-dist
- Raster Rendering: @napi-rs/canvas
- Protocol: MCP (Model Context Protocol)
- Extension Format: MCPB (built via
mcpb pack)
Important Files
server/index.js- Main MCP server implementation (all tool definitions and helpers). Prefer incremental updates over rewrites.manifest.json- Claude Desktop extension metadata and UI stub. Update versions alongside package.json.manifest.mcpb.json- MCPB packaging manifestpackage.json- Node.js dependenciespdf-toolkit-mcp-share/- Shareable package for Cursor users. Mirror changes from server/index.js when APIs evolve.example-fw9.pdf- Sample form for smoke tests. Keep anonymized assets only.docs/MAINTAINERS.md- Maintainer onboarding and operationsdocs/RELEASE.md- Release checklistserver/qpdf-decrypt.js- The only path by which PDF Tools decrypts. Owns the password rules, the/Ppermission enforcement, the encrypted-input size cap, the one-at-a-time queue, and the 30-second deadline. It does not run qpdf itself. It also owns re-protection: restoring a source's own encryption onto the bytes a mutation produced, and proving the protection is unchanged before anything is written. See## Password Support.server/qpdf-decrypt-worker.js- The worker thread that does. The only module that loads the qpdf runtime, and never on the server's own thread. Decides nothing: it runs the qpdf passes the wrapper asks for and reports opaque reason codes.vendor/qpdf-wasm/- Reproducible QPDF WebAssembly build recipe. The promoted artifact undervendor/qpdf-wasm/runtime/is shipped in both the MCPB and the share ZIP at that same path, and is loaded by exactly one module,server/qpdf-decrypt-worker.js, which is started from exactly one place,server/qpdf-decrypt.js— a second importer, or a second starter, would bypass the safety rules and fails the artifact test. Do not hand-editruntime/orruntime.provenance.json; regenerate them withnode scripts/vendor-qpdf-wasm-runtime.mjs <extracted-build-directory>.npm run qpdf-wasm:verifyis a ~45-minute Docker release gate and must stay out ofnpm test; the fast binding lives intest/qpdf-wasm-runtime-artifact.test.js.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +5 lines · +109 tokens per session 9eecfc359062
- 4d ago First seen · 533 lines · 7,689 tokens per session scan E 43c06417acb7
PDF-Tools CLAUDE.md is an instructions file published in the GitHub repository Open-Document-Alliance/PDF-Tools (153 stars, last pushed today), licensed MIT. It adds 7,798 tokens to every session, about $0.0390 per session on Opus 5. A static security scan graded it E with 3 findings (instruction-override phrasing, nullifies safety policies, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
nutrient-pdf-mcp-server CLAUDE.md
Instructions for PSPDFKit/nutrient-pdf-mcp-server, covering nutrient pdf mcp server - claude memory, project overview, key features, architecture and mcp tools.
docs-to-pdf CLAUDE.md
Claude Code instructions for jean-humann/docs-to-pdf, covering claude development guide for docs-to-pdf, project overview, development environment setup, using mise (recommended) and install mise (if not already installed).
PDF-Writer CLAUDE.md
Instructions for galkahana/PDF-Writer, covering claude code context - pdf-writer development guide, project overview, coding standards discovered, project structure and key components.
notebooklm-wiki-pipeline CLAUDE.md
Instructions for capitalparser/notebooklm-wiki-pipeline, covering 05notebooklmwikipipeline — 프로젝트 컨텍스트, 핵심 문제, 아키텍처, 도구 구성 and 슬래시 커맨드.
agentic-resume-builder CLAUDE.md
Claude Code instructions for WtotdeD/agentic-resume-builder, covering agentic-resume-builder development guidelines, what this repo is, active technologies, package manager and validation.
zotero-fulltext-mcp AGENTS.md
AGENTS.md instructions for matthiaskloft/zotero-fulltext-mcp, covering agents.md, project shape, configuration contract, data safety rules and development commands.