Overview
The PDF Action Inspector is an MCP server designed to extract and analyze JavaScript Actions embedded in PDF files to support security analysis and research. It implements a three-layer architecture: (1) Core Inspector Layer handles PDF processing and Action extraction, returning Python native types (dict/list) for performance and data validation; (2) MCP Tools Layer (mcp_server.py) provides the MCP-compatible interface, performing input validation, error handling, and JSON serialization of results; and (3) the FastMCP Framework Layer manages hosting and network communication with MCP clients. The server exposes core analysis tools for extracting Actions and generating security prompts, as well as document overviews and annotation data, enabling comprehensive security assessments. Additional detailed tools enable targeted queries on fields, pages, and objects, along with trailer information. Cache management and password handling support encrypted PDFs, and configuration options (e.g., cache timeout, log level) facilitate integration into security workflows. This design emphasizes clean interfaces, testability, and AI-assisted risk assessment workflows for researchers and security teams analyzing PDF Actions.
Features
PDF Actions Security Analysis
Generate security analysis prompts from extracted Actions data to support threat assessment and risk scoring.
PDF Action Extraction Across All Levels
Extract raw PDF Actions from the document, pages, annotations, and form fields.
Document Overview and Metadata
Provide a comprehensive view of the document structure and metadata for context and auditing.
Annotations and Actions Loading
Load all annotations together with their associated Actions for holistic analysis.
Fields and Page Content Queries
Find form fields by name (with fuzzy matching) and extract text content from specific pages.
Detailed Object & Trailer Inspection
Retrieve detailed PDF object information and trailer dictionary to understand document construction.
Encrypted PDF Password Handling
Set in-session passwords for encrypted PDFs to enable analysis without persistent storage.
Cache Management
Manage analysis cache and configuration (e.g., cache timeout, status) to optimize performance.
Who Is This For?
- Security Analysts:Automate PDF Actions security analysis and risk assessment within security operations.
- Security Researchers:Study PDF action behaviors and validate security claims using AI-assisted tooling.
- Developers:Integrate the MCP server into security workflows and tooling with JSON-based outputs.
