Back to Browse

Csvto MCP Server

Developer ToolsModerate5.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Local CSV, JSON and Excel conversion. Files are never uploaded and never enter the context.

About

Local CSV, JSON and Excel conversion. Files are never uploaded and never enter the context.

Security Report

5.2
Moderate5.2Moderate Risk

This MCP server is well-designed with strong security fundamentals. It performs local file conversions without uploading data, has no authentication requirements (appropriate for local-only operation), and avoids dangerous patterns like arbitrary code execution or credential handling. Input validation via Zod schemas is thorough, and file operations are properly scoped. Minor code quality observations include broad exception handling and lack of explicit error logging, but these do not introduce security vulnerabilities. Supply chain analysis found 6 known vulnerabilities in dependencies (2 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

8 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

env_vars

Check that this permission is expected for this type of plugin.

Unverified package source

We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-bishop81-csvto-mcp": {
      "args": [
        "-y",
        "csvto"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

csvto

CSV, JSON and Excel conversion that runs where your data already is.

  • csvto-mcp — an MCP server. Point your AI assistant at a file path; it converts locally and writes the result beside it. Nothing is uploaded, and file contents never pass through the model's context.
  • @csvto/core — the conversion engine. No DOM, no fs, no network, so the same tested code runs in a browser, in a local MCP process, or on a server.

The same engine powers the browser tools at csvtosite.com, where conversion happens client-side and files are likewise never uploaded.

Install the MCP server

claude mcp add csvto -- npx -y csvto-mcp

Or in any MCP client's config:

{
  "mcpServers": {
    "csvto": { "command": "npx", "args": ["-y", "csvto-mcp"] }
  }
}

Requires Node 18+. Full tool list and behaviour: packages/mcp/README.md.

Types are inferred per column, not per cell

This is the part that matters, and where most converters quietly corrupt data. A column converts to numbers only if every value in it survives the round trip exactly. If one value would change, the whole column stays text:

  • 01234 keeps its leading zero instead of becoming 1234
  • A 16-digit account number stays itself instead of becoming 1.23457E+14
  • 1250.50 keeps its trailing zero instead of becoming 1250.5
  • A column never ends up as a mix of numbers and strings

Verified in tests: 01234 survives a CSV → xlsx → CSV round trip intact.

Develop

npm install
npm test          # 49 tests
npm run build

packages/core must stay environment-free — no window, no fs, no fetch. That constraint is what lets one tested engine serve every surface.

Licence

MIT

Reviews

No reviews yet

Be the first to review this server!