MarkItDown MCP exposes one `convert_to_markdown(uri)` tool that accepts `http:`, `https:`, `file:`, and `data:` URIs., The server runs with the privileges of the user that starts it and can read any file that user can access when given a matching file URI., Streamable HTTP and SSE modes are local-use alternatives to stdio; the README warns not to bind them to non-localhost interfaces unless the security implications are understood., The HTTP and SSE server modes have no authentication, so any local process or user that can reach the bound interface can use the conversion tool., Use a container, virtual machine, or dedicated low-privilege user when converting untrusted documents or when file access must be tightly bounded.
Privacy notes
File paths, file contents, extracted Markdown, conversion errors, remote URLs, data URIs, and document metadata may become visible to the MCP client and model provider., Converting Office files, PDFs, media, web pages, or archives can reveal hidden text, comments, tracked changes, metadata, notes, image text, links, and embedded objects., Docker mounts make every mounted file readable to the MCP server path inside the container; mount only approved directories and prefer read-only mounts when possible., Remote URI conversion can reveal research targets, customer URLs, internal endpoints, or private document locations to upstream servers and to the model transcript.
Author
Microsoft
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
5 safety and 4 privacy notes across 2 risk areas. Review closely: network access.
2 areas
SafetyNetwork accessMarkItDown MCP exposes one `convert_to_markdown(uri)` tool that accepts `http:`, `https:`, `file:`, and `data:` URIs.
SafetyLocal filesThe server runs with the privileges of the user that starts it and can read any file that user can access when given a matching file URI.
SafetyNetwork accessStreamable HTTP and SSE modes are local-use alternatives to stdio; the README warns not to bind them to non-localhost interfaces unless the security implications are understood.
SafetyNetwork accessThe HTTP and SSE server modes have no authentication, so any local process or user that can reach the bound interface can use the conversion tool.
SafetyLocal filesUse a container, virtual machine, or dedicated low-privilege user when converting untrusted documents or when file access must be tightly bounded.
PrivacyNetwork accessFile paths, file contents, extracted Markdown, conversion errors, remote URLs, data URIs, and document metadata may become visible to the MCP client and model provider.
PrivacyLocal filesConverting Office files, PDFs, media, web pages, or archives can reveal hidden text, comments, tracked changes, metadata, notes, image text, links, and embedded objects.
PrivacyLocal filesDocker mounts make every mounted file readable to the MCP server path inside the container; mount only approved directories and prefer read-only mounts when possible.
PrivacyNetwork accessRemote URI conversion can reveal research targets, customer URLs, internal endpoints, or private document locations to upstream servers and to the model transcript.
Safety notes
MarkItDown MCP exposes one `convert_to_markdown(uri)` tool that accepts `http:`, `https:`, `file:`, and `data:` URIs.
The server runs with the privileges of the user that starts it and can read any file that user can access when given a matching file URI.
Streamable HTTP and SSE modes are local-use alternatives to stdio; the README warns not to bind them to non-localhost interfaces unless the security implications are understood.
The HTTP and SSE server modes have no authentication, so any local process or user that can reach the bound interface can use the conversion tool.
Use a container, virtual machine, or dedicated low-privilege user when converting untrusted documents or when file access must be tightly bounded.
Privacy notes
File paths, file contents, extracted Markdown, conversion errors, remote URLs, data URIs, and document metadata may become visible to the MCP client and model provider.
Converting Office files, PDFs, media, web pages, or archives can reveal hidden text, comments, tracked changes, metadata, notes, image text, links, and embedded objects.
Docker mounts make every mounted file readable to the MCP server path inside the container; mount only approved directories and prefer read-only mounts when possible.
Remote URI conversion can reveal research targets, customer URLs, internal endpoints, or private document locations to upstream servers and to the model transcript.
Prerequisites
Python 3.10 or newer and the `markitdown-mcp` package installed, or a locally built Docker image from the package Dockerfile.
Local files or remote resources that the MCP server's user is allowed to read and convert.
Sandboxed user, virtual machine, or container setup when exposing document conversion to an agent.
Explicit file and directory boundaries before mounting local data into a container.
Network policy reviewed before allowing conversions from remote HTTP or HTTPS resources.
MarkItDown MCP Server is Microsoft's MCP wrapper around the MarkItDown
conversion library. It exposes a single tool, convert_to_markdown(uri), that
turns a supported HTTP, HTTPS, file, or data URI into Markdown for Claude and
other MCP clients.
The dedicated markitdown-mcp package is separate from the core markitdown
library package. It supports stdio by default and can also run Streamable HTTP
or SSE for local trusted agents. The package README is explicit that the server
is meant for local use, does not support authentication, and should not be bound
to non-localhost interfaces unless the operator understands the security risks.
These sources were reviewed on 2026-06-06. Prefer the live repository,
package README, package metadata, MCP server entrypoint, PyPI pages, and license
for current command names, supported transports, URI behavior, and security
guidance.
Features
Microsoft-maintained MCP package for the MarkItDown conversion library.
Stdio server through markitdown-mcp.
Streamable HTTP and SSE modes for local trusted agents.
One convert_to_markdown(uri) tool.
URI support for HTTP, HTTPS, file, and data resources.
Docker guidance for running the server in a container.
Directory-mount pattern for exposing only selected local files to containerized conversion.
Localhost-by-default behavior for HTTP and SSE transports.
Security warning for non-localhost binding and unauthenticated access.
For stronger file boundaries, build and run the Docker image documented by the
package README, mounting only directories that the agent is allowed to convert.
Use Cases
Convert a reviewed PDF, Office document, or local file URI into Markdown for summarization.
Convert a remote public resource into Markdown before asking Claude to extract key points.
Use a containerized server to expose only a small approved document directory to Claude.
Standardize document conversion around Microsoft's MarkItDown library in MCP workflows.
Compare converted Markdown with the original source before using it in reports or decisions.
Safety and Privacy
MarkItDown MCP is intentionally simple, but the URI surface is sensitive. A
model that can call the tool can ask the server to read local files that the
server user can access, fetch network resources reachable by that user, and
convert data URIs supplied in prompts. Run it with limited permissions and keep
file mounts narrow.
Do not bind the HTTP or SSE transport to a broader interface without additional
network controls. The server has no built-in authentication and the README
warns that reachable processes or users can use it to read files and fetch
network resources available to the server process.
Duplicate Check
An existing markdownify-mcp-server entry mentions MarkItDown as a dependency
for some file conversion features, but it covers the separate
zcaceres/markdownify-mcp npm server. No dedicated microsoft/markitdown,
markitdown-mcp, Microsoft MarkItDown MCP, or matching source URL entry was
found in content/mcp, content/tools, content/guides, content/agents, or
content/skills.
Show that MarkItDown MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/markitdown-mcp-server)
How it compares
MarkItDown MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
MCP server for connecting Claude to AFFiNE Cloud or self-hosted AFFiNE workspaces, documents, databases, comments, collections, folders, tags, notifications, blobs, access tokens, semantic page composition, templates, edgeless canvas data, and workspace organization workflows over stdio or HTTP.
✓MarkItDown MCP exposes one `convert_to_markdown(uri)` tool that accepts `http:`, `https:`, `file:`, and `data:` URIs.
The server runs with the privileges of the user that starts it and can read any file that user can access when given a matching file URI.
Streamable HTTP and SSE modes are local-use alternatives to stdio; the README warns not to bind them to non-localhost interfaces unless the security implications are understood.
The HTTP and SSE server modes have no authentication, so any local process or user that can reach the bound interface can use the conversion tool.
Use a container, virtual machine, or dedicated low-privilege user when converting untrusted documents or when file access must be tightly bounded.
✓Markdownify MCP Server can read local files and convert documents, spreadsheets, presentations, images, audio files, and Markdown files.
File conversion tools should be restricted with MD_ALLOWED_PATHS or container mounts before using the server with sensitive directories.
Audio transcription, image OCR, document conversion, and webpage extraction can expose hidden text, metadata, comments, and embedded content.
Webpage, YouTube, and Bing tools retrieve external content that can contain prompt-injection text or unsafe instructions.
Review converted Markdown before using it as source material for decisions, publications, or further tool calls.
✓Office Word MCP Server can create, copy, merge, convert, protect, sign, and modify Word documents.
Editing tools can alter paragraphs, tables, lists, images, footnotes, endnotes, formatting, styles, comments, and document properties.
Review generated documents before sharing, signing, converting to PDF, or using them as legal, financial, HR, policy, or customer-facing material.
Keep backups before running broad search-and-replace, merge, delete, protection, or formatting operations on important documents.
✓The full tool surface can create, update, publish, revoke, move, replace, and delete AFFiNE workspaces, documents, folders, collections, comments, database rows, blobs, surface elements, tags, and access tokens.
Start with AFFINE_TOOL_PROFILE=read_only or disable groups such as destructive, admin, blobs, users, access_tokens, docs.database, or write when the assistant only needs discovery or reading.
HTTP mode exposes MCP endpoints and must be protected with bearer or OAuth authentication, HTTPS, allowed origins, and deployment-level access controls.
AFFiNE Cloud requires API tokens for MCP usage; avoid trying to automate email/password login against Cloud deployments.
Cookie and password-based auth can grant broad account access and should be avoided for unattended or shared deployments.
Privacy notes
✓File paths, file contents, extracted Markdown, conversion errors, remote URLs, data URIs, and document metadata may become visible to the MCP client and model provider.
Converting Office files, PDFs, media, web pages, or archives can reveal hidden text, comments, tracked changes, metadata, notes, image text, links, and embedded objects.
Docker mounts make every mounted file readable to the MCP server path inside the container; mount only approved directories and prefer read-only mounts when possible.
Remote URI conversion can reveal research targets, customer URLs, internal endpoints, or private document locations to upstream servers and to the model transcript.
✓File paths, file contents, extracted text, OCR output, audio transcripts, webpage text, search results, prompts, tool arguments, and conversion errors may be visible to the MCP client and model provider.
Documents and media can contain personal data, customer material, credentials, internal plans, meeting recordings, legal drafts, and proprietary screenshots.
Avoid pointing the server at broad home, workspace, downloads, or cloud-sync directories unless every file in scope is approved for model access.
✓Word documents can contain personal data, comments, tracked decisions, hidden metadata, embedded images, confidential business text, signatures, and restricted-editing sections.
Document text, filenames, comments, metadata, prompts, tool arguments, generated outputs, and conversion logs may be visible to the MCP client and model provider.
Review generated files and extracted comments before sharing logs, diffs, or documents publicly.
✓Workspaces, document titles, document bodies, comments, tags, database schemas, database rows, edgeless canvas data, notifications, user profiles, access-token metadata, blobs, and exported markdown can be sent to the MCP client and model.
API tokens, cookies, passwords, bearer tokens, OAuth config, and saved config files should be treated as secrets and kept out of prompts, logs, screenshots, issues, and committed MCP config.
Generated or modified documents can persist in AFFiNE and may become visible to collaborators depending on workspace permissions and sharing state.
Blob upload, cleanup, export, and publish/revoke workflows can expose files, generated content, or collaboration state beyond the current prompt.
Prerequisites
Python 3.10 or newer and the `markitdown-mcp` package installed, or a locally built Docker image from the package Dockerfile.
Local files or remote resources that the MCP server's user is allowed to read and convert.
Sandboxed user, virtual machine, or container setup when exposing document conversion to an agent.
Explicit file and directory boundaries before mounting local data into a container.
Node.js and npx available to the MCP client runtime.
Python and markitdown dependencies available for file conversion features.
Optional Docker setup if you want mounted read-only directories and explicit allowed paths.
MD_ALLOWED_PATHS configured when the server should be restricted to specific file directories.
Python 3.11 or newer available to the MCP client runtime.
uvx available for package execution.
Word documents or a working directory where generated documents can be created.
Review rules for documents the agent may overwrite, merge, convert, protect, or sign.
Node.js and npm for installing the affine-mcp-server package.
AFFiNE Cloud API token or approved self-hosted AFFiNE credentials.
AFFiNE base URL for the Cloud or self-hosted deployment.
Clear workspace scope and least-privilege tool profile before enabling write, admin, destructive, blob, or access-token tools.