postmd-mcp-server

MCPattestedlive

v2.6.0io.github.reinlainerMITUpdated 7d agonpm GitHub

MCP server for PostMD — publish Markdown as a shareable web page, with document graphs

Endpoint healthlive

checked 11 days ago · 1257ms

50% of the last 2 checks reached this endpoint

Works in

ClaudeCursorCopilotChatGPTGemini

Inferred from the transports this listing declares (stdio, streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build

A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.

450Downloads/wk

7d agoLast update

Reads these credentials

POSTMD_API_KEYAPI keyoptional
Needed only for managing documents and groups. Publishing and reading work without it.

Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.

Package

Authorio.github.reinlainer

LicenseMIT

Version2.6.0

Sourcenpm+mcp-registry

npmpostmd-mcp-server

GitHubreinlainer/postmd-mcp-server

SBOMCycloneDX 1.6 ↓

Trust Status

A

85/100Trusted

✓Listed in Forge index+10/10

✓Identity verified · attested build+20/20

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

✓npm Trusted Publishing (Sigstore)+5/5

—npm maintainer match+0/5

→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusIdentity verified

PublisherUnverified

SignatureUnsigned

Domain—

Provenance✓ Sigstore-verified · 029bb97

Dependencies✓ 60 resolved+ · none vulnerable

Tool surface20 tools · 4 privileged

Security scan✓ Cleanv2.6.0 · 2d agoHow well does this scan work?

EvalsNone

IndexedSep 2, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

20 tools · 4 privileged

Statically extracted from the published packagev2.6.0 · 2d ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

postmd_create_documentPublish Markdown as a PostMD web page. No API key required — anyone can publish.

Publish Markdown as a PostMD web page. No API key required — anyone can publish.

No input schema was published for this tool.

postmd_create_document_from_fileSame as postmd_create_document, but reads the Markdown from filePath on the machine

Same as postmd_create_document, but reads the Markdown from filePath on the machine

No input schema was published for this tool.

postmd_create_documents_from_filesPublish several .md files in one call (bulk upload). Requires an API key with

Publish several .md files in one call (bulk upload). Requires an API key with

No input schema was published for this tool.

postmd_get_documentGet document metadata by docCode: title, fileName, hasPassword,

Get document metadata by docCode: title, fileName, hasPassword,

No input schema was published for this tool.

postmd_get_document_rawGet the stored Markdown source of a document. Public — no API key needed.

Get the stored Markdown source of a document. Public — no API key needed.

No input schema was published for this tool.

postmd_update_documentUpdate a document. Password-protected documents require the password or the owner's API key;

Update a document. Password-protected documents require the password or the owner's API key;

No input schema was published for this tool.

postmd_update_document_from_fileSame as postmd_update_document, but reads the new Markdown from filePath on the

Same as postmd_update_document, but reads the new Markdown from filePath on the

No input schema was published for this tool.

postmd_delete_documentprivilegedDelete a document. Password-protected documents require the password or the owner's API key;

Delete a document. Password-protected documents require the password or the owner's API key;

No input schema was published for this tool.

postmd_list_notesList notes and highlights on a document: your own plus every SHARED one, newest

List notes and highlights on a document: your own plus every SHARED one, newest

No input schema was published for this tool.

postmd_add_noteAttach a note or highlight to a document. Requires an API key with documents:write.

Attach a note or highlight to a document. Requires an API key with documents:write.

No input schema was published for this tool.

postmd_update_noteEdit a note you wrote. Requires an API key with documents:write. Omitting scope

Edit a note you wrote. Requires an API key with documents:write. Omitting scope

No input schema was published for this tool.

postmd_resolve_noteMark a note as settled, or undo it with resolved=false. Meaningful on SHARED

Mark a note as settled, or undo it with resolved=false. Meaningful on SHARED

No input schema was published for this tool.

postmd_delete_noteprivilegedDelete a note: your own, or a SHARED note on a document you own. Requires an API

Delete a note: your own, or a SHARED note on a document you own. Requires an API

No input schema was published for this tool.

postmd_list_my_notesList every note the key's member wrote, across all documents, with docCode and

List every note the key's member wrote, across all documents, with docCode and

No input schema was published for this tool.

postmd_list_groupsList groups the key's member belongs to. Requires an API key with groups:read. Paged.

List groups the key's member belongs to. Requires an API key with groups:read. Paged.

No input schema was published for this tool.

postmd_list_group_documentsList documents in a group. Requires an API key with groups:read and documents:read.

List documents in a group. Requires an API key with groups:read and documents:read.

No input schema was published for this tool.

postmd_move_document_to_groupprivilegedMove a document you own into a group. A document belongs to exactly one group, so this

Move a document you own into a group. A document belongs to exactly one group, so this

No input schema was published for this tool.

postmd_create_groupCreate a group. Requires an API key with groups:write. Documents can then be filed into it.

Create a group. Requires an API key with groups:write. Documents can then be filed into it.

No input schema was published for this tool.

postmd_update_groupRename a group. Owner only. Requires an API key with groups:write.

Rename a group. Owner only. Requires an API key with groups:write.

No input schema was published for this tool.

postmd_delete_groupprivilegedDelete a group. Owner only; the default group cannot be deleted. Documents in it

Delete a group. Owner only; the default group cannot be deleted. Documents in it

No input schema was published for this tool.

20 of 20 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

MCP server for PostMD — publish Markdown as a shareable web page, with document graphs

Keywords

mcppostmdmarkdownpublishingdocument-graph

Alternatives

Comparing tool surfaces…

Tools exposed

20 tools · 4 privileged · observed 2026-10-03 by static extraction. A tool surface is what one scan read on one day, not a live capability list.

postmd_create_document
postmd_create_document_from_file
postmd_create_documents_from_files
postmd_get_document
postmd_get_document_raw
postmd_update_document
postmd_update_document_from_file
postmd_delete_documentpriv
postmd_list_notes
postmd_add_note
postmd_update_note
postmd_resolve_note
postmd_delete_notepriv
postmd_list_my_notes
postmd_list_groups
postmd_list_group_documents
postmd_move_document_to_grouppriv
postmd_create_group
postmd_update_group
postmd_delete_grouppriv

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-03 — observed resolution, not a publisher declaration.

60 packages resolved · 2 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

dotenv16.4.5
@modelcontextprotocol/sdk1.30.017 dependencies
- ajv8.20.04 dependencies
  - fast-deep-equal3.1.3
  - fast-uri3.1.8
  - json-schema-traverse1.0.0
  - require-from-string2.0.2
- zod4.6.5
- cors2.8.6+1 not drawn1 dependency
  - object-assign4.1.1
- hono4.13.12
- jose6.2.12
- express5.2.1+27 not drawn1 dependency
  - content-type1.0.5
- raw-body3.0.2+4 not drawn
- ajv-formats3.0.11 dependency
  - ajv8.20.0shown above
- cross-spawn7.0.6+3 not drawn
- eventsource3.0.71 dependency
  - eventsource-parser3.1.1
- content-type1.0.5shown above
- pkce-challenge5.0.1
- @hono/node-server2.1.3
- json-schema-typed8.0.2
- eventsource-parser3.1.1shown above
- express-rate-limit8.7.0+2 not drawn
- zod-to-json-schema3.25.2

The crawl stopped at the depth-4 limit. Anything below that level was never resolved.

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

package cap reached: 49
below the depth cap: 5

wrappy 1 — required by once@1.4.0package cap reached
http-errors ^2.0.1 — required by send@1.2.1package cap reached
mime-types ^3.0.2 — required by send@1.2.1package cap reached
ms ^2.1.3 — required by send@1.2.1package cap reached
on-finished ^2.4.1 — required by send@1.2.1package cap reached
range-parser ^1.2.1 — required by send@1.2.1package cap reached
statuses ^2.0.2 — required by send@1.2.1package cap reached
ms ^2.1.3 — required by debug@4.4.3package cap reached
debug ^4.4.0 — required by router@2.2.0package cap reached
depd ^2.0.0 — required by router@2.2.0package cap reached
is-promise ^4.0.0 — required by router@2.2.0package cap reached
parseurl ^1.3.3 — required by router@2.2.0package cap reached

+42 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.

Topics

Related in documents & pdfs

yusufkaraaslan/Skill_SeekersConvert documentation websites, GitHub repositories, and PDFs into Claude AI skills with a
nexu-io/html-anything✨ The agentic HTML editor — your local AI agent writes the HTML, you ship it. 🚀 75 Skills
Zipstack/unstractLLM-Driven Extraction of Unstructured Data — Built for API Deployments & ETL Pipeline Work
OpenSenseNova/SenseNova-SkillsModular SenseNova skills for building AI-powered office assistants and productivity workfl
agenticnotetaking/arscontextaClaude Code plugin that generates individualized knowledge systems from conversation. You
zcaceres/markdownify-mcpA Model Context Protocol server for converting almost anything to Markdown
KhazP/vibe-coding-prompt-templateTemplates and workflow for generating PRDs, Tech Designs, and MVP and more using LLMs for
@modelcontextprotocol/server-pdfMCP server for loading and extracting text from PDF files with chunked pagination and inte