Eleven MCP tools that shell out to markitdown
Markdownify MCP is a Model Context Protocol server written in TypeScript. A desktop app that speaks MCP launches it, and the AI agent gets eleven tools that return a local file, a web page or a Git repository as Markdown.
The conversion happens somewhere else. Nine of those tools shell out to markitdown, Microsoft's Python converter covered in the MarkItDown entry, and git-repo-to-markdown hands off to repomix. Only get-markdown-file does its own work, which is reading an existing .md file. Markdownify contributes the MCP layer, URL fetching and a directory allowlist. Microsoft ships a server of its own, markitdown-mcp, with a single tool, convert_to_markdown.
The open source OCR comparison sets Markdownify MCP against OCR engines and the other Markdown converters.
Whole Git repos packed into a single document
- One tool per format: PDF, DOCX, XLSX, PPTX, image and audio by absolute path; web page, YouTube video and Bing search by URL. Every tool carries the
readOnlyHintannotation. - A whole Git repo as one document:
git-repo-to-markdowntakes a GitHub URL or theowner/reposhorthand, plus a branch, tag or commit. Thecompressflag runs the code through Tree-sitter, which cuts the output by about 70% according to the tool's own description. The README's tool list leaves it out. - An allowlist on every file tool: since v1.1.0,
MD_ALLOWED_PATHSapplies to each tool that reads a file. Without it, the server reads anything its process is allowed to read. - Checks on URLs:
httpandhttpsonly, a host that is a private IP gets refused, and every redirect is checked again. When markitdown hands back raw HTML, which usually means a JavaScript-rendered page, the server returns an error.
Needs Python, and allowlist bypasses remain unfixed
Python and markitdown are required. bun install creates a .venv virtual environment and installs markitdown[all] into it, pulling in pandas, SpeechRecognition and the Azure SDKs along the way. The server only speaks STDIO; HTTP transport sits in a pull request opened in August 2026 (#133). To avoid Python, anydoc converts office files with a Rust binary run through npx, and it installs as an Agent Skill rather than an MCP server.
No OCR, and audio goes to Google. Called without an LLM client, markitdown's image converter returns the metadata of a JPEG or PNG (size, author, date, GPS position) and nothing more, and only if exiftool is installed. Text in a photo or a scanned PDF stays where it is: markitdown leaves OCR to a plugin that needs an LLM client, or to Azure services, and Markdownify enables neither. Audio is transcribed by the SpeechRecognition library, which sends it to Google's Speech Recognition API with a generic key and the language fixed to US English.
The three web tools are really one. Web page, YouTube or Bing, the URL is downloaded to a temporary file and that file goes to markitdown. markitdown's YouTube and Bing converters only kick in when they receive a URL, so the generic HTML converter runs instead. For YouTube, pull requests #100 (May 2026) and #131 (August 2026) describe the result: the site footer where the transcript should be. Neither has been merged.
The Docker image is incomplete. Since v1.0.4 it installs only markitdown[pdf], a fix for a crash on ARM. The README warns that audio and image conversion fail in it, and going by markitdown's optional dependencies, DOCX, XLSX and PPTX are missing theirs as well.
Reported security holes are still open. URL validation checks the hostname, not the address it resolves to: issue #112 (June 2026) gets a request to http://[::1] through. The allowlist can be sidestepped with a symlink (#108) or with a sibling directory that shares a prefix (#123), and the maintainer's fix (#104) has been waiting for a merge since May 18, 2026. Issue #112 rates the risk lower on a local single-user machine than behind a remote MCP gateway.
Nothing has landed on main since May 1, 2026. Five releases came out between March 27 (v1.0.1) and that date (v1.1.0, also published on npm as mcp-markdownify-server). Zach Caceres wrote 89 of the 123 commits. Pull request #88, which swaps markitdown for a TypeScript port so Python is no longer needed, has been waiting since March 2026 for that port to reach npm.