Mcp Server Upstage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Server Upstage (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for Upstage AI's document digitization and information extraction capabilities
The Upstage MCP Server provides a robust bridge between AI assistants and Upstage AI’s powerful document processing APIs. This server enables AI models—such as Claude—to effortlessly extract and structure content from various document types including PDFs, images, and Office files. The package supports multiple formats and comes with seamless integration options for Claude Desktop.
Before using this server, ensure you have the following:
This guide provides step-by-step instructions to set up and configure the mcp-upstage
uv (Recommended)No additional installation is required when using uvx as it handles execution. However, if you prefer to install the package directly:
uv pip install mcp-upstageFor integration with Claude Desktop, add the following content to your claude_desktop_config.json:
%APPDATA%\Claude\claude_desktop_config.json~/Library/Application Support/Claude/claude_desktop_config.json{
"mcpServers": {
"mcp-upstage": {
"command": "uvx",
"args": ["mcp-upstage"],
"env": {
"UPSTAGE_API_KEY": "<your-api-key>"
}
}
}
}If uvx is not available globally, you may encounter a Server disconnected error. To resolve this, run which uvx to find its full path, and replace "command": "uvx" above with the returned path.
Processing results are stored in your home directory under:
~/.mcp-upstage/outputs/document_parsing/
~/.mcp-upstage/outputs/information_extraction/
~/.mcp-upstage/outputs/information_extraction/schemas/
Follow these steps to set up and run the project locally:
git clone https://github.com/UpstageAI/mcp-upstage.git
cd mcp-upstage# Install uv if not already installed
pip install uv
# Create and activate a virtual environment
uv venv
# Activate the virtual environment
# On Windows:
# .venv\Scripts\activate
# On macOS/Linux:
source .venv/bin/activate
# Install dependencies in editable mode
uv pip install -e .claude_desktop_config.json file with the following configurations:For Windows:
{
"mcpServers": {
"mcp-upstage": {
"command": "uv",
"args": [
"run",
"--directory",
"C:\\path\\to\\cloned\\mcp-upstage",
"python",
"-m",
"upstage_mcp.server"
],
"env": {
"UPSTAGE_API_KEY": "your_api_key_here"
}
}
}
}Replace C:\\path\\to\\cloned\\mcp-upstage with your actual repository path.
For macOS/Linux:
{
"mcpServers": {
"mcp-upstage": {
"command": "/Users/username/.local/bin/uv",
"args": [
"run",
"--directory",
"/path/to/cloned/mcp-upstage",
"python",
"-m",
"upstage_mcp.server"
],
"env": {
"UPSTAGE_API_KEY": "your_api_key_here"
}
}
}
}Replace:
/Users/username/.local/bin/uv with the output of which uv./path/to/cloned/mcp-upstage with the absolute path to your local clone.Tip for macOS/Linux users: If connection issues occur, using the full path to your uv executable can improve reliability.
After configuring, restart Claude Desktop.
The server exposes two primary tools for AI models:
file_path – the path to the document to be processed; output_formats (optional) – output formats such as html, text, markdown; mode (default standard) – standard, enhanced or auto. Use enhanced for complex tables, charts, handwriting or low-quality scans; auto lets the API decide per page; ocr (default force) – force always runs OCR, auto uses embedded text of digital documents when possible; model (default document-parse) – the latest model, or a dated version such as document-parse-260930 to pin it.
Processed by document-parse-260930 | usage: {"pages": 1, "enhanced": [1]}. If the requested standard/enhanced mode was not applied, a WARNING line follows.enhanced (and pages that auto routes to enhanced) is billed at a higher per-page price than standard and is slower. Keep the default standard unless the document needs it."Can you parse the document at `C:\Users\username\Documents\contract.pdf` and provide a summary?" "Parse the scanned form at `~/Documents/form.pdf` in enhanced mode."
file_path – the document file path; schema_path (optional) – a JSON file with an extraction schema; auto_generate_schema (default true) – whether to auto-generate a schema.
"Extract the invoice number, date, and total from `C:\Users\username\Documents\invoice.pdf`."
Ensure that your UPSTAGE_API_KEY is correctly set in your claude_desktop_config.json file. Obtain a valid API key from Upstage Console.
Double-check the file path for correctness and accessibility. Ensure that file paths are absolute (e.g., C:\Users\name\Documents\file.pdf) and that any special characters in the path are properly escaped.
Verify that your virtual environment is activated and all dependencies are installed. Additionally, review the Claude Desktop log files for errors:
%APPDATA%\Claude\logs\mcp-upstage.log~/Library/Logs/Claude/mcp-upstage.logRestart Claude Desktop. Ensure that uvx is installed and available in your system PATH, or use its absolute path in your configuration if needed.
Check that the document is in a supported format (PDF, JPEG, PNG, TIFF, etc.), its file size is under 50MB, and it contains fewer than 100 pages. Test with a simpler document to confirm functionality.
Verify that the document is in a supported, uncorrupted format.
Confirm your network connection, firewall settings, and configuration details in claude_desktop_config.json. Review the logs for more detailed error messages.
For troubleshooting, view the server logs at:
%APPDATA%\Claude\logs\mcp-upstage.log
~/Library/Logs/Claude/mcp-upstage.log
This repository publishes a Python package. MCP clients run it locally over stdio; the workflows do not deploy a hosted HTTP server.
| Destination | Trigger | Workflow | GitHub environment | Secret |
|---|---|---|---|---|
| TestPyPI | Push to dev | Publish to TestPyPI | test-pypi | TEST_PYPI_API_TOKEN |
| PyPI | Publish a GitHub Release | Publish to PyPI | pypi | PYPI_API_TOKEN |
Configure the secrets as GitHub Actions repository secrets or in the corresponding environment. These workflows currently use API tokens, not Trusted Publishing. UPSTAGE_API_KEY is required to run the MCP server and call Upstage APIs; it is separate from the publishing credentials.
Merging into main or pushing a tag alone does not publish to PyPI. A draft release does not publish either. Publishing a GitHub Release, including a prerelease, triggers the PyPI workflow. Use TestPyPI to validate a package before a public release.
main and dev, reconcile changes, and review the commits included in the release.__version__ in src/upstage_mcp/__init__.py. Hatch reads the package version from this file; the release tag does not set it. Use a patch increment for fixes and a minor increment for new functionality, consistent with recent releases.uv lock after changing the version or dependencies, and commit the updated uv.lock when it changes.Run these checks from the repository root before pushing release changes to dev:
uv lock --check
uv sync --frozen --extra dev
UPSTAGE_API_KEY=dummy uv run --frozen pytest -q
uv buildA dummy key is sufficient for the automated tests, but not for real API calls. CI also tests fresh installations without the lockfile on Python 3.10 and 3.12, plus a locked installation.
After pushing to dev, confirm both CI and Publish to TestPyPI succeeded for the intended commit, and check that the expected wheel and source distribution exist on TestPyPI. CI and publishing run independently; a successful upload does not prove CI passed. Inspect the built package and test its MCP behavior before promoting it.
dev to mainCreate a release PR with dev as the head and main as the base. The branch-policy workflow automatically closes newly opened PRs to main unless their head is this repository's dev branch.
gh pr create --base main --head dev --title "release: <version>"Describe the included changes and validation results in the PR description.
Wait for the release PR's checks and required reviews to pass, then merge it. Verify that the merged commit contains exactly the version and changes you intend to publish. CI is not a dependency of the PyPI publishing workflow, so complete this verification before publishing the release.
Use the merged release PR's exact commit as the tag target. Replace the placeholders below; the version must match __version__ and must be unused on PyPI. Existing releases use tags without a v prefix, such as 0.2.0.
RELEASE_VERSION="<new-version>"
RELEASE_PR="<merged-release-pr-number>"
RELEASE_SHA=$(gh pr view "$RELEASE_PR" --json mergeCommit --jq '.mergeCommit.oid')
git fetch origin main --tags
git show "$RELEASE_SHA:src/upstage_mcp/__init__.py"
# Run only after confirming the commit and version above.
gh release create "$RELEASE_VERSION" \
--target "$RELEASE_SHA" \
--title "Upstage MCP v$RELEASE_VERSION" \
--generate-notes \
--latestConfirm that the tag points to the intended commit. If the tag already exists, --target does not move it; verify the existing tag before publishing. Do not retag a published release to repair a package.
build and publish in Publish to PyPI to finish successfully. Check the run's commit SHA against the release commit; a queued run or a published GitHub Release alone is not deployment proof.uv run --no-project --index-url https://pypi.org/simple \
--refresh-package mcp-upstage --with "mcp-upstage==$RELEASE_VERSION" \
python -c 'from importlib.metadata import version; print(version("mcp-upstage"))'Configure an MCP client with the following command and arguments, replacing <version> with the released version. Supply a real UPSTAGE_API_KEY through the client's environment settings.
{
"command": "uvx",
"args": ["--index-url", "https://pypi.org/simple", "--refresh-package", "mcp-upstage", "mcp-upstage==<version>"]
}Restart the client, initialize the MCP connection, and list tools. Confirm parse_document and extract_information are available and the parsing schema exposes mode, ocr, and model.
For an end-to-end check, use a small synthetic document with known values. Verify default/standard, enhanced, and auto parsing, the API-reported model and per-mode usage, information extraction, and the saved result files under ~/.mcp-upstage/outputs/. Test automatic schema generation and an explicit schema. These calls use the real Upstage API and incur normal usage charges; enhanced processing can cost more than standard. Import or tool-list checks alone do not verify document processing.
Known limitation observed with `mcp-upstage 0.2.0` and `mcp 1.30.0`: passing a JSON object encoded as a schema_json string fails MCP argument validation before the extraction API is called. Automatic schema generation and schema_path with a JSON schema file were verified successfully. Record this limitation when validating 0.2.0; do not count the failing path as passed.
If publishing fails, inspect the failed job before retrying. Check token access, the version, and whether either distribution was already uploaded. Do not assume a failed workflow means no files reached the index. For a faulty published package, fix the code and release a new version rather than overwriting the existing one.
Contributions are welcome! If you wish to enhance the project or add new features, please fork the repository and submit a pull request. For major changes, please open an issue first to discuss what you would like to change.
This project is licensed under the MIT License.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.