superdocs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited superdocs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A skill for AI agents (Claude Code, Cursor, Claude Desktop, Windsurf, VS Code Copilot, etc.) connecting to the SuperDocs MCP server at https://api.superdocs.app/mcp.
This skill encodes the workflows that work well with SuperDocs and the pitfalls to avoid. Read the section that matches what the user is asking for; you don't need the whole file.
Before reading the rest of this skill, check whether SuperDocs MCP tools are accessible. Look for tools prefixed with mcp__superdocs__, mcp__plugin_superdocs_superdocs__, or just superdocs__ (depending on your client).
If yes → MCP server is connected. Skip to "When to use" below.
If no → MCP server isn't connected yet. Add it now using the command appropriate for your tool. You only need to do this ONCE — after the first add, the server stays connected for the session and future sessions. Do NOT re-run this check on every tool call; if you've already verified MCP is accessible OR have already added it this session, skip directly to using the tools.
| Tool | Command |
|---|---|
| Claude Code | claude mcp add --transport http superdocs https://api.superdocs.app/mcp/ --header "Authorization: Bearer sk_YOUR_KEY" (or just install the plugin which bundles MCP + skill + 4 prompts: claude plugin marketplace add superdocsapp/superdocs-plugin && claude plugin install superdocs@superdocs-plugin) |
| Cursor / VS Code | Add to .cursor/mcp.json (or workspace .vscode/mcp.json): {"mcpServers":{"superdocs":{"url":"https://api.superdocs.app/mcp/","headers":{"Authorization":"Bearer sk_YOUR_KEY"}}}} |
| Cline / Continue / Goose / Gemini CLI / others | See client-specific docs at https://docs.superdocs.app/mcp/setup — config file format varies. |
Get a free API key at https://use.superdocs.app → Settings → API Keys → Create. Free plan = 500 ops/month.
After adding, restart your session if your client requires it (Claude Code does), then continue with the rest of this skill.
Reach for SuperDocs when any of these are true:
.docx, PDF, HTML, or styled file and wants to modify specific sections without breaking the surrounding format. Plain LLM rewrites lose tables, borders, alternating row shading, fonts..docx, .pdf, AND .html with consistent visual fidelity.chat with the full draft request — SuperDocs writes the document with proper formatting in one turn. Don't generate the document HTML in your context first; that wastes thousands of tokens AND skips SuperDocs' formatting layer.Skip SuperDocs (use plain text generation or a different tool) when:
README.md or a plain .txt log).The user installs the SuperDocs MCP server in their AI tool's config. They need an API key from https://use.superdocs.app (Settings → API Keys → Create). Keys look like sk_a1b2c3d4....
~/.config/claude-code/mcp.json:
{
"mcpServers": {
"superdocs": {
"type": "http",
"url": "https://api.superdocs.app/mcp",
"headers": { "Authorization": "Bearer sk_YOUR_API_KEY" }
}
}
}Restart Claude Code. The 21 SuperDocs tools become available; this skill auto-loads when document work is requested.
mcp.json in the project or workspace:
{
"mcpServers": {
"superdocs": {
"url": "https://api.superdocs.app/mcp",
"headers": { "Authorization": "Bearer sk_YOUR_API_KEY" }
}
}
}~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or equivalent on Windows/Linux:
{
"mcpServers": {
"superdocs": {
"command": "npx",
"args": ["mcp-remote", "https://api.superdocs.app/mcp", "--header", "Authorization: Bearer sk_YOUR_API_KEY"]
}
}
}Files <100KB (small contracts, single-page memos, brief outlines): inline base64 is fine.
TOOL: upload_document_base64
ARGS:
filename: "contract.docx"
file_base64: <base64-of-file-bytes>
session_id: "user-session-1"Files >100KB (multi-page styled docx, full PDFs): use the pre-signed URL flow so bytes never pass through your context window.
STEP 1 — TOOL: request_upload_url
ARGS:
filename: "long-contract.docx"
content_type: "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
size_bytes: 245000
purpose: "document"
RETURNS: { upload_id, upload_url, curl_example }
STEP 2 — Execute the `curl_example` yourself via your Bash tool. Do
not paste the curl command back to the user expecting them to run it
— uploading the file is your job, not theirs. The bytes go straight
from disk to cloud storage; nothing flows through your context. Only
return the curl text to the user as a fallback if you genuinely have
no shell access.
STEP 3 — TOOL: process_uploaded_document
ARGS:
upload_id: <from step 1>
filename: "long-contract.docx"
session_id: "user-session-1"
parse_mode: "document" # or "attachment" for read-only reference
RETURNS: { document_html with chunk IDs, version_id }Why this matters: A 100KB docx becomes ~140K base64 chars in your context — for Claude Sonnet 4.6 that's ~70% of your window gone before the user has even asked a question. The pre-signed URL flow keeps bytes out of context entirely.
The default path: let SuperDocs write the document. Don't draft the full HTML in your context and upload it — that wastes thousands of tokens AND yields plain HTML instead of a properly-formatted SuperDocs document. SuperDocs creates the entire document natively in one turn when you ask it to.
STEP 1 — Initialize an empty session:
TOOL: upload_document_base64
ARGS:
filename: "draft.html"
file_base64: <base64 of "<html><body></body></html>">
session_id: "user-session-1"
STEP 2 — Call chat with the full draft request:
TOOL: chat
ARGS:
message: "Draft a 1-page mutual NDA between Acme Corp and Beta Ltd, governed by Delaware law, with a 3-year term. Include standard sections: definitions, obligations, exclusions, term, return/destruction, no license, governing law, signatures."
session_id: "user-session-1"
STEP 3 — Iterate via additional chat calls as needed:
TOOL: chat
ARGS:
message: "Add an injunctive relief clause after section 6"
session_id: "user-session-1"
STEP 4 — Export when done:
TOOL: export_document
ARGS:
session_id: "user-session-1"
format: "docx"
filename: "final.docx"Optional: scaffold structure first for long multi-section docs. If the document is large enough that you want the user to react to the structure before content is generated (e.g., a 20-section employee handbook), draft a brief outline in your reply for the user to confirm, then call chat with that outline embedded in the message: "Draft this document. Use this structure: 1) Introduction; 2) Scope; 3) Pricing; 4) Termination; 5) Signatures." Same one-call pattern; SuperDocs still writes the actual content.
For documents >20 pages, the chat response will normally include the entire updated HTML on every turn (~130K tokens for a 100-page styled doc). After 5 turns that's ~650K tokens — well past most context windows.
Always set `response_mode='compact'` for large-doc editing:
TOOL: chat
ARGS:
message: "Make the second paragraph in section 3 bold"
session_id: "user-session-1"
response_mode: "compact"In compact mode the response includes only chunk_diffs (per-section before/after) for the chunks that actually changed — typically 1-3 chunks, ~500-2,000 tokens total. The same 5-turn editing session above drops from ~650K tokens to ~3K tokens.
To read a section in compact mode, just ask for it in natural language — "show me the force majeure clause" or "what does section 4.2 currently say?". The AI returns the content in the chat reply text. You don't need to know about chunk IDs and shouldn't try to query for them.
When changes are sensitive (legal contracts, financial filings, anything that goes to an external party), ask SuperDocs to surface each change for the user to approve before applying.
STEP 1 — TOOL: chat_async
ARGS:
message: "Update all party names from 'Acme' to 'NewAcme' across the document"
session_id: "user-session-1"
approval_mode: "ask_every_time"
response_mode: "compact"
RETURNS: { job_id }
STEP 2 — Poll TOOL: get_job until status='awaiting_approval'.
The result contains `pending_changes: [{change_id, chunk_id, old_html, new_html, ai_explanation}, …]`
STEP 3 — Show the diff to the user, get their decision per change.
STEP 4 — TOOL: approve_change for each:
ARGS:
session_id: "user-session-1"
job_id: <from step 1>
change_id: <from pending_changes>
approved: true # or false with feedback for revision
feedback: "Looks good" # optionalOnce all decisions are recorded, the job auto-resumes and applies the approved changes.
After the user is happy with the document:
TOOL: export_document
ARGS:
session_id: "user-session-1"
format: "docx" # or "pdf" or "html"
filename: "delivery.docx"For files the user needs to download (rather than viewing inline), use the pre-signed download URL flow:
STEP 1 — TOOL: export_document → returns the file
STEP 2 — TOOL: request_download_url with the resulting file's blob path
STEP 3 — Execute the returned curl command yourself via your Bash
tool to save the file to the user's working directory. Do
not paste the curl command back to the user expecting them
to run it manually — downloading is your job, not theirs.
Only return the URL+command as text if you genuinely have
no shell access, OR if the user explicitly asked for "just
the URL" / "the curl command".If the user wants the AI to consult a file (compliance manual, brand guide, prior contract) while editing a different document, upload it as an attachment — SuperDocs processes it for AI-searchable retrieval (text content is indexed for meaning-aware search; images are interpreted visually) so chat can search and cite it.
STEP 1 — TOOL: upload_attachment_base64 (small) or request_upload_url + process_uploaded_document with parse_mode='attachment' (large)
STEP 2 — TOOL: get_attachment_status — wait until status='ready'
STEP 3 — Continue with chat. The AI now has the attachment available for retrieval.upload_document_base64 with <html><body></body></html>.chat with the full request: "Draft a 1-page mutual NDA between {X} and {Y}, governed by {jurisdiction} law, with a {N}-year term. Include standard sections: definitions, obligations, exclusions, term, return/destruction, no license, governing law, signatures."chat calls if needed (e.g., "Add an injunctive relief clause"). Each chat turn is one billable operation.export_document as .docx.request_upload_url + process_uploaded_document.chat (compact mode) with "Identify clauses that are unfavorable to {party}, and explain each in 1-2 sentences." — the AI returns a list in its reply, no edits needed.chat again with "Add inline annotations highlighting each red-flag clause".upload_document_base64 (it's almost certainly under 100KB).export_document with format='docx'.request_upload_url + process_uploaded_document.chat_async with approval_mode='ask_every_time' and response_mode='compact' so the user can review each replacement before it lands.pending_changes, compact-mode chunk_diffs) and can pass them back when explicitly relaying IDs SuperDocs already issued (e.g., change_id in approve_change). You should never try to construct or guess one.session_id across all calls for one document. Generate a new one (e.g., user-${timestamp}) per logical document. State persists across restarts via the SuperDocs backend.compact only when context cost matters.'document' loads as the active editable doc, 'attachment' loads as a read-only AI-searchable reference. Don't mix them up.pending_changes — compact mode only affects the post-edit confirmation response shape, not the pre-approval review shape. Both work together.Authorization: Bearer sk_… header. Individual tool calls don't need extra auth.upload_document_base64 with <html><body></body></html>, then call chat with the full draft request. SuperDocs writes the document natively in one turn. Generating the full HTML in your own context and then uploading it wastes thousands of tokens AND yields plain HTML instead of a properly-formatted SuperDocs document with chunk IDs ready for further editing."bold only the paragraph beginning 'Curabitur', leave the following paragraphs unchanged" — to avoid sibling-element collateral edits inside the same chunk.available-tools.mdx)Chat & editing: chat, chat_async, approve_change, revert_session_to_message Document upload/parse: upload_document_base64, request_upload_url, process_uploaded_document Document export/download: export_document, request_download_url Sessions: list_sessions, get_session_history, get_session_jobs Attachments (reference files): upload_attachment_base64, delete_attachment, get_attachment_status Async jobs: list_jobs, get_job, cancel_job Templates: upload_template_base64, list_user_templates, delete_user_template Health: health
For full schemas and parameter descriptions, see the SuperDocs MCP tools reference.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.