What are the risks of connecting to npm:docqa-mcp?

References sensitive file paths / environment secrets. Overall trust grade C- (70/100).

When was npm:docqa-mcp last audited?

Last checked 2026-06-03; wmcp.sh re-checks it on a schedule for tool drift and rug-pulls.

C-

npm:docqa-mcp

Item: npm:docqa-mcp
Rating: 70
Author: wmcp.sh

https://www.npmjs.com/package/docqa-mcp

70/100 · MCP Trust Grade · checked 1mo ago · MCP 1.0.2

Is the npm:docqa-mcp MCP server safe to use?

Independent trust grade C- (70/100). References sensitive file paths / environment secrets. wmcp.sh continuously watches npm:docqa-mcp for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

What it offers — 5 tools · Developer Tools

docqa-verify

Verify AI extraction results against an original document. Detects hallucinated values, arithmetic errors, and field mismatches. Returns a confidence

docqa-sample

Fetch a sample DocQA verification report to understand the output format. Free, no API key needed for this tool. Use this to preview DocQA output befo

pdf-extract

Extract structured text and tables from a PDF document. Returns text content, page count, detected tables, and metadata.

ocr

Extract text from an image using Tesseract OCR. Supports PNG, JPG, TIFF, BMP, WebP. Returns recognized text and confidence score.

convert

Convert a document between formats. Input formats: pdf, md, json, txt. Output formats: txt, md, json.

Spec / packaging20%100

✓ depends on an MCP SDK
✓ declares a bin entry (runnable server)
✓ 5 tool(s) detected in source

Security (OWASP MCP)30%25

⚠ references sensitive file paths / env secrets
scanned 1 source file

Maintenance / popularity20%92

published within 90 days
3 published versions

Tool hygiene15%70

no TypeScript types
2 runtime deps

Transparency / provenance15%90

✓ public repository linked
✓ MIT license

Findings

WARNMCP08 References sensitive file paths / environment secrets.

INFO Static analysis of npm package docqa-mcp@1.0.2 (stdio server — no remote endpoint). Reliability/behavioral signals require running it; not measured.

Grade another server

We re-grade npm:docqa-mcp on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — npm:docqa-mcp grade C-

Share on X Open card image

https://wmcp.sh/mcp/grade/npm%3Adocqa-mcp

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

Markdown (for your README)

[![MCP Trust Grade C-](https://wmcp.sh/mcp/grade/npm%3Adocqa-mcp/badge.svg)](https://wmcp.sh/mcp/grade/npm%3Adocqa-mcp)

HTML

<a href="https://wmcp.sh/mcp/grade/npm%3Adocqa-mcp"><img src="https://wmcp.sh/mcp/grade/npm%3Adocqa-mcp/badge.svg" alt="MCP Trust Grade C- · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust

How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.