markitdown-mcp

microsoft/markitdown/packages/markitdown-mcp

MarkItDown-MCP is an MCP server that converts web pages, local files, and data URIs into Markdown using Microsoft's MarkItDown library. The biggest risk is that when run directly on the host machine, a prompt injection can use the tool to read sensitive local files via file: URIs and exfiltrate them or probe internal network services via http: and https: URIs.

What it can reach

Files

Reads any local file that the user running the server has permission to access when given a file: URI.

Network

Fetches arbitrary http: and https: URLs, and can optionally run an unauthenticated HTTP/SSE listener (bound to 127.0.0.1:3001 by default).

Findings

1. HighUnrestricted local file read and exfiltration via URI schemes

   packages/markitdown-mcp/src/markitdown_mcp/__main__.py:24

   The convert_to_markdown tool accepts any file:, http:, or https: URI without restricting local file paths to an allowed directory. When installed and run directly on the host rather than in an isolated container, untrusted content processed by the agent can use prompt injection to read sensitive local files (such as ~/.ssh/id_rsa, ~/.aws/credentials, or .env files) via a file: URI and then exfiltrate the contents by calling the tool again with an attacker-controlled https: URL.

   Fix: Add configuration flags to restrict file: URIs to an explicit allowlist of base directories (resolving symlinks before checking) or to disable the file: scheme entirely when not needed.

2. MediumServer-side request forgery (SSRF) to internal network services

   packages/markitdown-mcp/src/markitdown_mcp/__main__.py:22

   When converting http: or https: URIs, the server fetches the target URL without blocking loopback addresses, private network ranges, or cloud metadata services (such as 169.254.169.254). An attacker who can influence tool arguments via prompt injection can make the server fetch and return responses from internal services that are not meant to be publicly reachable.

   Fix: Validate resolved IP addresses before making outbound HTTP requests and reject loopback, link-local, and private network ranges unless explicitly permitted by the user.

3. LowStarlette debug mode hardcoded to True in HTTP transport

   packages/markitdown-mcp/src/markitdown_mcp/__main__.py:65

   When the server is started with --http or --sse, create_starlette_app is called with debug=True hardcoded. In Starlette, debug mode causes unhandled server exceptions to return detailed stack traces in HTTP responses, which can leak internal file paths and implementation details to connected clients.

   Fix: Pass debug=False by default in main(), or only enable debug mode when an explicit --debug flag is provided.