markdownify-mcp: Don't Install It Until It's Patched (Oct 2026)

Don't install markdownify-mcp until it's patched. Three published vulnerabilities still affect the latest version (1.1.0). One lets a prompt reach internal network services, and another lets it read files outside the folders you allowed. The fix for the second has sat unmerged since May 2026. TrustedMCP grades it D.

What it is

markdownify-mcp is a local MCP server that turns PDFs, Word, PowerPoint and Excel files, images, audio, web pages and Git repos into Markdown so an agent can read them. It runs over stdio with no authentication. It's published on npm as mcp-markdownify-server (an earlier version of this guide said there was no package; that changed in March 2026).

Under the hood it passes the model-supplied file path or URL to helper programs (markitdown, and repomix for Git repos).

The open vulnerabilities

Three older issues (command injection, arbitrary file read, another SSRF) were fixed in Git in 2025 but only reached npm users in 1.0.0 in March 2026. If you installed it before then, you were exposed for months.

You can check any server's current status on Registry Watch, which re-checks public vulnerability databases daily.

If you must use it

Only with input you fully control, and only in isolation:

1. Run it in a container with no network access (that blocks the SSRF) and no credentials to anything that matters.
2. Mount only the folder it should read, and set MD_ALLOWED_PATHS to that folder. Don't rely on the allowlist alone, because of CVE-2026-14699.
3. Never point it at URLs or files that came from an untrusted source, such as a web page or an email the agent just read.

npx -y mcp-markdownify-server

Claude Desktop / Cursor config:

{
  "mcpServers": {
    "markdownify": {
      "command": "npx",
      "args": ["-y", "mcp-markdownify-server"],
      "env": { "MD_ALLOWED_PATHS": "/abs/path/to/one/folder" }
    }
  }
}

Why it grades D

It loses points on every signal. No authentication (0/30). No maintainer activity since May 2026 (10/25). Open, unpatched advisories (0/25). It passes model-controlled input to helper programs (0/20). See the markdownify-mcp listing, how TrustedMCP scores servers, and the 5-minute check for judging alternatives.