Developers: MCP for AI assistants

What it is

PDF Loft runs an MCP server, so an AI assistant can run PDF tools, follow the run and save the result for you. It is reachable by web address and speaks streamable HTTP. There is nothing to install and no package to run.

Server address

https://api.pdfloft.com/mcp

MCP for AI assistants is included in the Pro plan and above. A tool run through MCP uses the same task pool as the web app, so there is no separate allowance. Listing tools, documents and runs costs nothing; starting a run counts one task per output file, and a run that fails is not counted.

Connect Claude

Open Claude and go to Settings, then Connectors.
Choose to add a custom connector and paste the server address above.
Claude opens a PDF Loft page that asks you to sign in and approve. Check the application name and the access listed, then choose Allow.
Ask Claude to work on a PDF, for example: "Compress the PDF at this address and save the result to my library."

The menu names can differ between versions of the app. The server address is the only value you enter.

Connect ChatGPT

Open ChatGPT settings and find Connectors (some plans call this Apps, and custom connectors may need developer mode to be switched on).
Create a connector, name it PDF Loft, and paste the server address above. Choose OAuth when asked how to authenticate.
Sign in to PDF Loft in the page that opens and choose Allow.

Connect other clients

Any client that supports remote MCP servers over HTTP with OAuth can connect from the address alone: it finds the sign-in server, registers itself and asks you to approve. For a client configured with a file, the entry is usually this:

JSON

{
  "mcpServers": {
    "pdfloft": { "url": "https://api.pdfloft.com/mcp" }
  }
}

For a script or a client that cannot open a browser, send an API key instead (Team plan and above). The key needs the scopes of the tools you call.

curl

curl https://api.pdfloft.com/mcp \
  -H "Authorization: Bearer $PDFLOFT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

How sign-in works

The server follows OAuth 2.1 with PKCE. A client finds the sign-in server from /.well-known/oauth-protected-resource, registers itself at /oauth/register (RFC 7591), sends you to the approval page, and exchanges the code at /oauth/token. The state parameter is required, redirect addresses must match the registered address exactly (an application on your own computer may use any port on a loopback address), and refresh tokens are used once: using one twice ends the connection.

You can end a connection at any time in Settings, then Connections, under Connected apps. The next call from that assistant fails. A connection also ends when you leave the account or the account falls below the Pro plan.

Scopes

The access an assistant is given is the same set of scopes an API key can hold. The approval page lists them before you allow anything. A tool that needs a scope the connection lacks answers with insufficient_scope and is not listed.

Scopes an MCP connection can hold
Scope	Allows
`tools:run`	Upload files, run PDF tools and cancel runs.
`jobs:read`	Read runs and download their results.
`documents:read`	List documents and download them.
`documents:write`	Save documents to the library and delete them.
`webhooks:manage`	Create, list and delete webhook endpoints.
`signatures:send`	Create, send, remind and void signature requests, and send from a template in bulk.
`signatures:read`	Read templates and signature requests, and download signed documents and certificates.

Tools

Every tool is named pdfloft_<area>_<resource>_<verb>. The input of each tool is described by a JSON Schema in tools/list, built from the same validators as the REST API, and the options of a PDF tool are returned by pdfloft_tools_tool_get. The signature tools make, send, remind, void and download signature requests under the same plan allowance, visibility rules and webhook events as the signature API. Signers still sign on the secure page their email links to; no tool signs for a person.

MCP tools
Tool	Scope	Changes data	What it does
`pdfloft_tools_tool_list`	`tools:run`	No	List every PDF tool PDF Loft can run, with the file types it reads and how many files one run takes.
`pdfloft_tools_tool_get`	`tools:run`	No	Get one tool by its id, including the options it takes as a JSON Schema.
`pdfloft_tools_run_create`	`tools:run`	Yes	Start a tool on uploaded files.
`pdfloft_files_file_upload`	`tools:run`	Yes	Upload one file given as base64, up to 700 KB.
`pdfloft_files_url_import`	`tools:run`	Yes	Fetch a file from a public https address and keep it for a run.
`pdfloft_files_document_import`	`documents:read`	Yes	Copy a document from the library so a tool can run on it.
`pdfloft_jobs_job_get`	`jobs:read`	No	Get the status, progress and result count of a run.
`pdfloft_jobs_job_list`	`jobs:read`	No	List your recent runs, newest first.
`pdfloft_jobs_job_cancel`	`tools:run`	Yes	Cancel a run that has not finished.
`pdfloft_jobs_result_link`	`jobs:read`	No	Get a signed link to download one result file of a finished run.
`pdfloft_documents_document_list`	`documents:read`	No	List the documents in the library that you can see, newest first.
`pdfloft_documents_document_get`	`documents:read`	No	Get one document from the library.
`pdfloft_documents_document_create`	`documents:write`	Yes	Save an uploaded PDF or one result file of a run to the library.
`pdfloft_documents_document_download`	`documents:read`	No	Get a signed link to download a document version.
`pdfloft_documents_document_delete`	`documents:write`	Yes	Delete a document and all its versions from the library.
`pdfloft_cloud_connection_list`	`tools:run`	No	List the cloud storage services you connected in PDF Loft settings (Google Drive, Dropbox, OneDrive, Box).
`pdfloft_cloud_file_list`	`tools:run`	No	List the files and folders in a Dropbox, OneDrive or Box folder.
`pdfloft_cloud_file_import`	`tools:run`	Yes	Copy a file from a connected cloud storage service so a tool can run on it.
`pdfloft_cloud_file_export`	`documents:read`	Yes	Save a library document, or one result file of a finished run, to a connected cloud storage service.
`pdfloft_signatures_template_list`	`signatures:read`	No	List the reusable signature templates of the account, with their signer roles and fields.
`pdfloft_signatures_request_create`	`signatures:send`	Yes	Make a signature request from an uploaded PDF, a library document or a template, with its signers and fields, and send it at once when asked.
`pdfloft_signatures_request_list`	`signatures:read`	No	List the signature requests you can see, newest first, optionally by status.
`pdfloft_signatures_request_get`	`signatures:read`	No	Get one signature request with the status of each signer.
`pdfloft_signatures_request_send`	`signatures:send`	Yes	Send a draft signature request to its signers.
`pdfloft_signatures_request_remind`	`signatures:send`	Yes	Remind the signers whose turn it is to sign.
`pdfloft_signatures_request_void`	`signatures:send`	Yes	Cancel a signature request that is not complete.
`pdfloft_signatures_request_download`	`signatures:read`	No	Get a signed link to the signed PDF or the completion certificate of a completed request.

Limits and errors

An OAuth connection may make 120 calls a minute. An API key uses its own limit. A refused call answers 429 with Retry-After.
A tool that fails returns a result with isError set and the same stable error code the REST API uses, such as tasks.exhausted, so the assistant can explain what happened.
A missing or expired credential answers 401 with a WWW-Authenticate header that names the sign-in server. A plan below Pro answers 402.
The server keeps no session and sends no server-initiated messages, so GET and DELETE on the address answer 405.