MCP server

net.convertica/mcp

mcp:convertica-net/convertica-mcp

Convert PDF, Word, Excel, PowerPoint, EPUB, HEIC & images — 35+ tools from convertica.net

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 11:23 UTC at 2617658

findings

high

highest severity

threat classes

files scanned

90/90

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/index.js:52:PERSIST

Security findings 1

Persistence

highContextual risklow confidence

The filename taken from the remote response's Content-Disposition header is joined into the output path without stripping path separators, so a malicious or compromised API endpoint (including one set via CONVERTICA_API_BASE) could write files outside the intended output directory.

src/index.js:52

if (plain) return plain[1].trim();

vector:code

Counter-argument considered

The filename comes from the server's Content-Disposition header. It is never stripped of path separators before path.join and writeFileSync. A name like ../../x would write outside the output directory, which contradicts the declared behavior of saving next to the input or into output_dir. This is a real but low-severity path traversal bug.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

highRefutedlow confidence

convert_file reads any agent-supplied local path with no path restriction and uploads it to the API host (overridable via the undeclared-in-server.json CONVERTICA_API_BASE env var) together with the bearer API key, so a prompt-injected agent could send arbitrary files off-host; this is the declared core upload capability and not itself malicious.

src/index.js:79

form.append(field, new Blob([fs.readFileSync(file)]), path.basename(file));

Why it was refuted

Reading local files and uploading them with the API key to convertica.net is the declared core capability of convert_file. The tool description declares both the upload and the CONVERTICA_API_KEY use. The finding itself concedes this is not malicious, and the API base override is operator-controlled configuration.