# DocMorph Studio

> Render Mermaid diagrams, Markdown to PDF and outlines, image OCR, and media metadata cleanup.

- name: dev.docmorph/docmorph-studio
- version: 1.0.2
- connection class: R0 (autonomous)
- trust: 82/100 flags: no-repository
- quality: 73/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.docmorph%2Fdocmorph-studio
- tools: https://api.protogrid.dev/v1/servers/dev.docmorph%2Fdocmorph-studio/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "docmorph-studio": {
      "type": "http",
      "url": "https://docmorph.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 99
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-97% +updated-8d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 73/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: render_mermaid_diagram (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); sanitize_media_security (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); convert_markdown_to_pdf (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 2,532 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 11 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 11, about 2,532 tokens to load them all
- tool set hash: 8face57f88e7a6df409cc07ce8b05d74
- tools last changed: 2026-10-14T18:16:28.309Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.docmorph/docmorph-studio.svg)](https://protogrid.dev/servers/dev.docmorph/docmorph-studio)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-14 `word_inspect_security` added
  - Inspect the security and privacy state of a Word .docx: whether it is password-encrypted and with which algorithm, editing restriction mode and whether it is password-protected, presence of a text watermark, and privacy metadata (author, last modified by, company, manager, timestamps, custom properties, comment/revision author names). For encrypted files, pass the password to also inspect the contents. Max input 20MB base64. Privacy: when called remotely (Streamable HTTP / SSE) the file is uploaded to the DocMorph server and processed in memory only; it is not written to disk or retained after processing, and passwords and file contents are never logged. When the MCP server runs locally over stdio, the file is processed entirely on this machine.
- 2026-10-14 `word_remove_password` added
  - Remove the open password from an encrypted Word .docx (Agile encryption, Office 2010+) using the known password, with integrity (HMAC) verification. Returns the decrypted .docx as base64. A wrong password returns a clear WRONG_PASSWORD error; this tool does not crack or guess passwords. Max input 20MB base64. Privacy: when called remotely (Streamable HTTP / SSE) the file is uploaded to the DocMorph server and processed in memory only; it is not written to disk or retained after processing, and passwords and file contents are never logged. When the MCP server runs locally over stdio, the file is processed entirely on this machine.
- 2026-10-14 `word_protect` added
  - Protect a Word .docx document in one call: set an open password (Agile AES-256 encryption, opens in Microsoft Word / WPS / LibreOffice), add a native Word text watermark, add copyright info (author/custom property/footer), clean privacy metadata, and restrict editing (read-only / comments only / tracked changes only / forms, optionally password-protected). Returns the protected .docx as base64 plus a summary of applied operations. Max input 20MB base64. Privacy: when called remotely (Streamable HTTP / SSE) the file is uploaded to the DocMorph server and processed in memory only; it is not written to disk or retained after processing, and passwords and file contents are never logged. When the MCP server runs locally over stdio, the file is processed entirely on this machine.
- 2026-10-11 `audio_security_sanitize` removed
  - Permanently wipe and sanitize audio metadata (strip ID3 tags, RIFF LIST INFO, BWF bext chunks, recorder hardware signatures, timestamps) with zero audio re-encoding and zero quality degradation.
- 2026-10-11 `audio_security_inspect` removed
  - Deeply inspect audio files (MP3, WAV, M4A, FLAC, OGG) for ID3v1/ID3v2 tags, RIFF chunks, BWF broadcast headers, GPS coordinates, recorder hardware fingerprints, and timestamps.
- 2026-10-11 `video_security_sanitize` removed
  - Permanently wipe and sanitize video metadata (neutralize moov.udta into free boxes, zero mvhd timestamps, erase ISO 6709 GPS tags) with zero re-encoding and zero video quality degradation.
- 2026-10-11 `video_security_inspect` removed
  - Deeply inspect video files (MP4, MOV, WebM) for ISO-BMFF box atoms, Apple metadata (udta/meta), ISO 6709 GPS coordinates, recording timestamps, and camera hardware tags.
- 2026-10-11 `image_security_sanitize` removed
  - Permanently strip EXIF, XMP, GPS coordinates, and camera metadata from image files with zero image recompression and zero quality loss.
- 2026-10-11 `image_security_inspect` removed
  - Deeply inspect image files (JPEG, PNG, WebP) for EXIF, XMP, IPTC, camera make/model, serial numbers, and physical GPS latitude/longitude coordinates.
- 2026-10-11 `html_to_pdf_print` removed
  - Convert HTML or rich formatted document text into a clean publication-ready PDF document with elegant typography and auto pagination.

Full history: https://api.protogrid.dev/v1/servers/dev.docmorph%2Fdocmorph-studio/changes

## Remotes

- https://docmorph.dev/mcp (streamable-http, auth none, reachable true, uptime30d 0.9677419)
- https://docmorph.dev/mcp/sse (sse, auth none, reachable false, uptime30d 0.9677419)

## Packages

_none_

## Tools (11)

- `assist_ocr_text`: AI assistant to translate, proofread, or summarize extracted OCR document text.
- `convert_markdown_to_pdf`: Compile Markdown text into a styled, publication-ready PDF document with automatic pagination and headers.
- `extract_markdown_outline`: Extract hierarchical headings, table of contents, word/character statistics, and document structure outline from Markdown text.
- `image_ocr_recognize`: Extract multilingual text, complex headings, formulas, and tabular data from images using multimodal AI vision.
- `inspect_media_security`: Deeply inspect image, video, or audio files for privacy leaks, including GPS physical coordinates, camera/recorder hardware serials, recording timestamps, and editing software signatures.
- `parse_pdf_to_markdown`: Extract structured Markdown, tables, and mathematical formulas from a base64 encoded PDF using AI vision OCR.
- `render_mermaid_diagram`: Render a Mermaid diagram into styled SVG vector image code and node metadata. Supports flowchart/graph and sequenceDiagram (sequence) types. Other types (ER/gantt/mindmap/pie/state) should be rendered on client-side using mermaid.js.
- `sanitize_media_security`: Permanently wipe and sanitize privacy metadata from image, video, or audio files (strip GPS coordinates, device fingerprints, timestamps, and comments) with zero quality loss.
- `word_inspect_security`: Inspect the security and privacy state of a Word .docx: whether it is password-encrypted and with which algorithm, editing restriction mode and whether it is password-protected, presence of a text watermark, and privacy metadata (author, last modified by, company, manager, timestamps, custom properties, comment/revision author names). For encrypted files, pass the password to also inspect the contents. Max input 20MB base64. Privacy: when called remotely (Streamable HTTP / SSE) the file is uploaded to the DocMorph server and processed in memory only; it is not written to disk or retained after processing, and passwords and file contents are never logged. When the MCP server runs locally over stdio, the file is processed entirely on this machine.
- `word_protect`: Protect a Word .docx document in one call: set an open password (Agile AES-256 encryption, opens in Microsoft Word / WPS / LibreOffice), add a native Word text watermark, add copyright info (author/custom property/footer), clean privacy metadata, and restrict editing (read-only / comments only / tracked changes only / forms, optionally password-protected). Returns the protected .docx as base64 plus a summary of applied operations. Max input 20MB base64. Privacy: when called remotely (Streamable HTTP / SSE) the file is uploaded to the DocMorph server and processed in memory only; it is not written to disk or retained after processing, and passwords and file contents are never logged. When the MCP server runs locally over stdio, the file is processed entirely on this machine.
- `word_remove_password`: Remove the open password from an encrypted Word .docx (Agile encryption, Office 2010+) using the known password, with integrity (HMAC) verification. Returns the decrypted .docx as base64. A wrong password returns a clear WRONG_PASSWORD error; this tool does not crack or guess passwords. Max input 20MB base64. Privacy: when called remotely (Streamable HTTP / SSE) the file is uploaded to the DocMorph server and processed in memory only; it is not written to disk or retained after processing, and passwords and file contents are never logged. When the MCP server runs locally over stdio, the file is processed entirely on this machine.