# Give your AI agent access to your PDFs without uploading them: local MCP

**Short answer.** An MCP server is a process that exposes tools to an AI agent.
If that server runs on your machine and opens no network connections, the agent
can read, classify and extract data from your PDFs without the file leaving the
machine: what travels to the model is the text you decide, already redacted if
you ask. It installs in one line, and from then on Claude Code, Claude Desktop,
Cursor or any MCP client treats your documents as one more source.

---

## What MCP is, plainly

**Model Context Protocol** is an open protocol that lets an AI agent discover and
use tools. The agent does not know how to read a PDF; it knows how to call a tool
named `read_document` and receive a structured answer. Who implements that tool,
and **where it runs**, is the decision that matters.

There are two families of document MCP servers:

- **Wrappers around a cloud API.** The server does run on your machine, but the
  first thing it does with your file is upload it to the vendor's service. The
  file leaves anyway; only the uploader changed.
- **Servers that process on your machine.** The server opens the PDF, reads it,
  extracts the text and returns the result without opening a single connection.

The difference is invisible in the agent's interface. It shows up in the network
tab, or by taking the machine offline.

## Why it changes what you can ask

With the file uploaded to a chat, some things simply do not get asked. A lawyer
does not upload the client's contract. A doctor does not upload the medical
record. Not out of technical distrust, but because the document is privileged and
uploading it is itself the transfer that should not happen.

With a local server, the split changes:

| What happens | Where |
|---|---|
| Open the PDF, OCR if needed | Your machine |
| Identify the document type | Your machine |
| Extract fields with page and position | Your machine |
| Redact personal data | Your machine |
| Reason over the already-redacted text | The model |

The only thing travelling to the model provider is the text the tool returns,
which you control and can request redacted. And if you also use a local model
with Ollama or LM Studio, nothing travels at all.

## What an agent can do with this

The practical difference is not «reading a PDF». It is that the agent can chain
steps without asking you at every turn:

- «Read every invoice in this folder, pull the total and the tax ID from each,
  and put them in a CSV.» The agent calls the tool per file, gets fields with
  their source page, and builds the table.
- «This 80-page scan is several documents stuck together; split them.» Detecting
  where a new document starts is a heuristic over each page's text, not a job for
  a vision model.
- «Turn these contracts into a fine-tuning dataset, without personal data.» The
  whole chain runs locally.
- «What kind of document is this and what can I do with it?» Classification by
  visible rules, with the signals that support it, so the agent does not invent.

The design key is that **every value carries its provenance**: which page, which
line, which box on the page. An agent that cites can be checked; one that
summarizes cannot.

## A dated example: iLovePDF's MCP server

On 27 September 2026 we reviewed the MCP server iLovePDF publishes
([`ilovepdf/ilovepdf-mcp`](https://github.com/ilovepdf/ilovepdf-mcp), package
`@ilovepdf/mcp` 0.1.0). It is a clear example of the first family, and it says
so itself: its architecture document explains that each call "uploads them to
the iLovePDF v1 REST API, triggers processing, downloads the produced file". It
runs on your machine over stdio, but the file travels to their service.

| | `@ilovepdf/mcp` | `@sirdaspdf/mcp` |
|---|---|---|
| Where the PDF is processed | On iLovePDF's servers | On your machine |
| Account or key | Requires "an iLovePDF public API key" | None |
| Tools | 10 in its architecture document; 9 active (unlock "temporarily disabled") | 27 |
| Office to PDF | Yes | No (Office to text only) |
| Works with networking off | No | Yes; tested on every change with `docker run --network none` |

Where theirs is better: it converts Word, Excel and PowerPoint **to PDF**, and
behind it is a mature service with many more web tools. If the document may
leave your machine, it is a reasonable choice. If it may not, the question is
not which server has more tools, but where the file is opened.

Nor are we the only PDF MCP server that processes locally: others exist, such
as `mcp-pdf` or `pdf-toolbox-mcp`. Check any of them the same way: see whether
it asks for an API key and whether it works offline.

## How to install it

For Claude Code, one line:

```bash
claude mcp add sirdas -- npx -y @sirdaspdf/mcp@0.4.3
```

For Claude Desktop, Cursor, VS Code or Windsurf, the standard MCP config:

```json
{
  "mcpServers": {
    "sirdas": { "command": "npx", "args": ["-y", "@sirdaspdf/mcp@0.4.3"] }
  }
}
```

And to prove it really is local, the test that admits no argument:

```bash
docker run --rm --network none -v "$PWD:/work" sirdas invoice.pdf
```

`--network none` leaves the container with no network interface. If the command
returns the parsed document, the work happened without a network.

## One call that does everything

The pattern that works with agents is not exposing twenty small tools and hoping
the model guesses the sequence. It is one tool that does the whole job and
returns, along with the result, **what to offer next**:

```json
{
  "status": "ok",
  "document_type": "invoice",
  "steps": ["Extracted text from 2 page(s).", "Identified as invoice.",
            "Extracted 8 field(s) with page citations."],
  "fields": [
    { "name": "total", "value": "1,428,000", "page": 2,
      "evidence": "Total due: $ 1,428,000" }
  ],
  "next_steps": [{ "tool": "pdf_tables", "why": "Export the line items to CSV." }],
  "bytes_sent": 0
}
```

Three details built for agents: `steps` explains what was done, so the agent can
tell the user; `evidence` lets it cite instead of assert; and `next_steps` saves
the model from guessing which tool comes next.

## What it does not do

- **It does not read handwriting**, nor detect a pen-ticked box on a scan. That
  needs a vision model.
- **It does not turn charts into data.**
- **It does not reproduce the layout** of Word, Excel or PowerPoint: it reads
  them for content, which is what a model needs.

Saying so matters, because an agent expecting a capability that does not exist
fails confusingly instead of with a clear error.

## Where to start

The full documentation, in Markdown so your own agent can read it, is in
[the developers section](/en/developers/). If you want the agent to install
itself, paste this:

> I want you to use Sırdaş to read and process my documents on my own machine,
> without uploading them anywhere. Read https://www.sirdaspdf.com/llms.txt, install the
> MCP server, try it on a PDF and tell me what you can now do with my files. Ask
> me before writing or changing files.