Back to Browse

Everypage MCP Server

Developer ToolsModerate6.0MCP RegistryLocal
Free

Server data from the Official MCP Registry

Share PDFs as tracked links and see who read them, how far they got, and where they stopped.

About

Share PDFs as tracked links and see who read them, how far they got, and where they stopped.

Security Report

6.0
Moderate6.0Moderate Risk

A well-engineered MCP server for the EveryPage PDF sharing service with strong security practices. Authentication is properly enforced via required API keys, permissions align with the service's purpose (PDF uploads, readership tracking), and the code demonstrates solid input validation and error handling. Minor findings around broad exception handling and logging practices present low-severity code quality concerns that do not materially impact security. Supply chain analysis found 2 known vulnerabilities in dependencies (1 critical, 0 high severity). Package verification found 1 issue.

4 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

What You'll Need

Set these up before or after installing:

EveryPage API key (ep_live_...), created at https://everypage.co/account. An OAuth access token (ep_at_...) also works, limited to its granted scopes.Required

Environment variable: EVERYPAGE_API_KEY

API origin override, for self-hosted or development instances.Optional

Environment variable: EVERYPAGE_BASE_URL

Set to true to expose only the read-only tools (no upload, no changes, no deletion).Optional

Environment variable: EVERYPAGE_READ_ONLY

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "co-everypage-mcp": {
      "env": {
        "EVERYPAGE_API_KEY": "your-everypage-api-key-here",
        "EVERYPAGE_BASE_URL": "your-everypage-base-url-here",
        "EVERYPAGE_READ_ONLY": "your-everypage-read-only-here"
      },
      "args": [
        "-y",
        "everypage-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

everypage-mcp

MCP server for EveryPage. Lets an AI assistant turn a PDF into a tracked share link, and tell you who actually read it — how far they got, how long they spent, and which page they stopped on.

"Share this proposal with Jane and Bob, then tell me tomorrow whether either of them read past the pricing page."

§ 01 Install

Get an API key from everypage.co/account — it looks like ep_live_…. Then point your client at the server.

Claude Code

claude mcp add everypage --env EVERYPAGE_API_KEY=ep_live_... -- npx -y everypage-mcp

Claude Desktop, Cursor, VS Code, and anything else that reads a JSON config

{
  "mcpServers": {
    "everypage": {
      "command": "npx",
      "args": ["-y", "everypage-mcp"],
      "env": { "EVERYPAGE_API_KEY": "ep_live_..." }
    }
  }
}

Requires Node 20 or newer.

§ 02 What it can do

ToolWhat it does
everypage_share_pdfUpload a PDF (local path or https URL) and get a tracked link, embed code and QR URL — applying share settings in the same call
everypage_list_filesList documents, optionally filtered by name
everypage_get_fileOne document's links, protection and status
everypage_update_file_settingsChange passcode, expiry, downloads, viewer mode, email gate, view limit, page range, slug
everypage_delete_fileTrash a document, or purge it permanently
everypage_replace_contentSwap the PDF behind a live link, keeping the link and its history · Pro
everypage_get_readershipWho read it, how far they got, where they dropped off
everypage_list_eventsRecent reads, downloads or captured leads, with a polling cursor
everypage_create_variantsOne tracked link per recipient, so reads are attributed by name · Pro
everypage_list_variantsThose links and their status
everypage_update_variantRename, revoke or restore one recipient's link · Pro
everypage_delete_variantDelete it, or GDPR-redact the recipient's name · Pro
everypage_list_webhooksWebhook endpoints and their delivery health
everypage_manage_webhookCreate, test or delete a webhook endpoint
everypage_accountThe connected account, its plan, and what that plan allows

Two prompts ship as slash commands: readership_digest (what happened over the last N days) and send_tracked_copies (one link per recipient, done right).

§ 03 Things worth knowing

Any way of naming a document works. Every tool that takes a file accepts a UUID, a short link id, or a share URL pasted straight out of the browser — including /embed/ links and ones carrying ?via= — so there is no need to look up an id first.

Uploads stream. A local path is read off disk rather than into memory, so a 2 GB document on the Pro plan uploads without the process growing. Files are checked for the PDF magic bytes and against your plan's size cap before anything is sent.

A URL is fetched without your credentials. The url lane downloads from the host you named using no EveryPage headers at all, then uploads the bytes. Your API key never travels to a third-party host.

Readership is summarized, not dumped. The tool computes the finding — the steepest drop in the reach funnel, the most re-read page — and puts the raw rows in structuredContent for anything that wants to chart them.

Event cursors are per-stream. everypage_list_events returns a nextCursor, and it is only valid for the same type. The three streams have independent id sequences; crossing them silently returns the wrong window.

Deleting is reversible by default. everypage_delete_file trashes, and says so; purge: true is the irreversible one. Tools that cannot be undone are marked with MCP's destructiveHint, so clients that support confirmation prompts will ask before running them.

§ 04 Configuration

VariableRequiredDefaultMeaning
EVERYPAGE_API_KEYyesep_live_… API key, or an ep_at_… OAuth token (limited to its granted scopes)
EVERYPAGE_BASE_URLnohttps://everypage.coAPI origin, for self-hosted or development instances
EVERYPAGE_READ_ONLYnofalsetrue exposes only the seven read-only tools

§ 05 Plans

Some features are plan-gated, and a refusal will say which plan is needed. everypage_account reports the current plan and what it locks.

FreeBasicPro
Upload size20 MiB200 MiB2 GiB
Live documents3100unlimited
Tracked links, share settings, webhooks
Passcode, view limits, view notifications, per-page stats
Per-recipient links, email-capture gate, content replacement, watermarks, page ranges

The API allows 120 requests per minute per key.

§ 06 Not included

/files/claim and the Canva publishing lane (app plumbing, not agent work), branding assets and hotspots (large Pro payloads with no natural agent use), and the authenticated QR fetch — the qr_url every tool returns is public and needs no credentials. Open an issue if you want any of them.

§ 07 Development

npm ci
npm run typecheck
npm test
npm run build
npm run inspector      # drive the tools by hand in the MCP inspector

The tool surface is snapshotted in test/schemas.test.ts: renaming a tool or one of its inputs fails CI on purpose, because it breaks every saved prompt and agent config that names it.

Field names and output shapes are pinned by the cross-integration contract shared with the EveryPage Zapier, Make and n8n integrations — change that first.

§ 08 Links

License

MIT

Reviews

No reviews yet

Be the first to review this server!