What it is
MarkItDown is Microsoft's Python tool for converting files and office documents to Markdown; the main repository has about 191,700 GitHub stars. The markitdown-mcp package wraps it as an MCP server, built by the AutoGen team.
It exposes exactly one tool, convert_to_markdown(uri), which accepts http:, https:, file: or data: URIs. It runs over stdio by default, or over Streamable HTTP and SSE with the --http flag, binding to localhost. Install it with pip install markitdown-mcp; for Claude Desktop the README recommends building the Docker image from the repository's Dockerfile and mounting one folder for local files. It is not listed in the official MCP registry.
The package is still alpha-versioned: 0.0.1a8 shipped on 21 October 2026 alongside MarkItDown 0.1.9, after a first alpha in March 2025.
Install
pip install markitdown-mcpOur review
MarkItDown MCP is the cheapest way, in context and in money, to let a local agent read Office files and PDFs, and its security model amounts to trusting everything on the machine. One tool means almost no context overhead, and the same call handles a local file, a URL or inline data.
Format coverage is wide: PDF, Word, PowerPoint, Excel, EPub, HTML, CSV, JSON and XML, images through EXIF metadata and OCR, audio through transcription, ZIP archives and YouTube URLs. The MCP package pins markitdown[all], so every optional converter is installed whether you need it or not, which is behind an open issue reporting failed installs on Windows ARM64.
The README's security section is unusually blunt. There is no authentication, the server runs with your user's privileges, and convert_to_markdown can read any file that user can read or fetch anything on the network. Put that next to an agent reading untrusted documents and a prompt-injected instruction to convert file:///home/you/.ssh/config is a plausible failure. The Docker route with a single mounted folder is the sensible default, though you build the image yourself: no official image is published.
What it does worse than rivals is everything after conversion. There is no search, chunking or page selection, so a 300-page PDF lands in context in one piece, and the output aims at text structure rather than faithful layout. After 19 months and eight alphas the package still carries a 0.0.1 version, and an open issue notes that VS Code's MCP gallery still installs 0.0.1a4.
Where it earns its place
A finance analyst at a 30-person firm using Claude Desktop
Summarise quarterly Excel and PowerPoint packs without uploading them to a web app
Build the Docker image, mount only the reports folder at /workdir and point Claude Desktop at docker run. Conversion is free and local; the cost is model tokens, since each workbook arrives whole.
An AI engineer building a document-ingestion agent on the Claude Agent SDK
Turn mixed customer uploads into Markdown before chunking
Run markitdown-mcp --http on 127.0.0.1:3001 inside a container and pass uploads as data: URIs, so the server never needs filesystem access. Chunking and page selection have to live in your own code.
A security engineer approving MCP servers for developer laptops
Decide whether MarkItDown can be installed
Allow only the Docker configuration with one mounted directory and no non-localhost binding. A bare pip install runs with the user's full file access, so a document carrying injected instructions could make the agent read files outside the project.
Before you commit
- Setup
- pip install markitdown-mcp (Python 3.10+) and run markitdown-mcp for stdio, or markitdown-mcp --http --host 127.0.0.1 --port 3001 for Streamable HTTP and SSE. For Claude Desktop, build the image from the Dockerfile and launch it with docker run. Minutes to the first call.
- Integrations
- One tool, convert_to_markdown(uri), taking http:, https:, file: or data: URIs. It writes nothing, but it can read anything the process can reach; the MCP Inspector is the documented debugging route.
- Data and privacy
- Runs locally with no account and nothing sent to Microsoft. There is no authentication, and in HTTP mode any local process or user can call it. Fetched pages and documents are untrusted text in the model's context.
- Cost at scale
- Free under MIT; the bill is model tokens. Because the tool has no page or size parameter, one long PDF can take a large share of the context window in a single call.
- Limits
- No paging, chunking or search, and layout is flattened to text structure. Open issues report Windows ARM64 install failures from the mandatory markitdown[all] dependency and VS Code's gallery installing the old 0.0.1a4.
What's good
- One tool, so almost no context overhead
- Converts PDF, Office, EPub, HTML, images, audio and ZIP
- Accepts file, http(s) and data URIs
- MIT licence; Dockerfile for isolation
What's not
- No authentication; reads any file the user can
- Whole documents land in context, with no paging
- No published Docker image; you build it
- Still alpha-versioned at 0.0.1a8
Best for
Developers who want an agent to read PDFs and Office documents locally without uploading them anywhere.
Alternatives
MarkItDown MCP: common questions
- Is MarkItDown MCP worth it?
- A one-tool document converter that earns its place, provided it runs in a container that can see only the files you mean it to. We rate it 3.9 out of 5.
- How much does MarkItDown MCP cost?
- Free and open source (MIT).
- What are the downsides of MarkItDown MCP?
- No authentication; reads any file the user can; whole documents land in context, with no paging; no published Docker image; you build it; still alpha-versioned at 0.0.1a8.
- Who is MarkItDown MCP best for?
- Developers who want an agent to read PDFs and Office documents locally without uploading them anywhere.
- How much does MarkItDown MCP cost for a team or in production?
- Free under MIT; the bill is model tokens. Because the tool has no page or size parameter, one long PDF can take a large share of the context window in a single call.
- Is MarkItDown MCP safe for company data?
- Runs locally with no account and nothing sent to Microsoft. There is no authentication, and in HTTP mode any local process or user can call it. Fetched pages and documents are untrusted text in the model's context.
- What are the best MarkItDown MCP alternatives?
- The closest alternatives we have reviewed are Fetch (reference server), Filesystem (reference server) and Firecrawl MCP.
Answers checked Oct 23, 2026.