Xberg API Server & MCP Protocol Integration
Expose document extraction as a REST API and MCP server for AI agents like Claude.
Evidence shows a security document (SECURITY.md) listing concrete mitigations for malicious document inputs (decompression bombs, path traversal, etc.) and conservative defaults (e.g., max compression ratio, timeouts), indicating security awareness and basic data-flow transparency. However, the skill document itself does not describe permission requirements or user confirmation mechanisms, and CORS defaults to permissive (relying on env vars to tighten). Publisher is unverified, so provenance cannot be confirmed. Therefore trust is capped at moderate, with deductions for missing permissions and confirmation details.
The skill document thoroughly describes the REST and MCP architecture, including error handling (e.g., ApiError mapping to HTTP status codes) and timeout settings, which support reliability. However, static review cannot run any critical paths, and there is no embedded test suite specifically covering this skill; only e2e test files (batch and code) exist, not directly linked to the skill definition. Thus reliability is limited to low-moderate because key paths were not actually verified in this static review.
The skill document clearly defines target use cases (REST API and MCP integration), provides detailed endpoint, parameter, and configuration information, aiding precise triggering. But it does not explicitly state non-fit boundaries or environment limitations (e.g., applicability to resource-intensive documents). For FollowSkills serving Chinese users, core functionality relies on local deployment, not blocked external services, which is positive. However, lack of boundary evidence limits the score to low-moderate.
The skill document is well-structured, providing locations, configuration, and examples, and the repository has an MIT license and clear authorship (listed in Cargo.toml). However, the skill document lacks version history or changelog, and does not clearly state maintenance responsibility and update path, though a security policy exists. These omissions reduce the convention score, but overall readability and basic governance are acceptable.
The skill document describes complete API and MCP functionality, but there are no actual outputs or verifiable demonstrations proving effectiveness. Static review cannot validate the value proposition, and no third-party execution evidence supports representative outputs. Therefore effectiveness is limited to low, as correctness and direct usability cannot be confirmed.
The repository contains CI workflows (benchmarks.yaml, ci-docker.yaml), but they target the overall project, not specifically validating this skill document's content. e2e test files exist but have weak direct association with this skill, and their source is auto-generated (alef), which is not independent corroboration. Thus verifiability is limited to low, as key claims lack reproducible, independent evidence.
- CORS defaults to permissive; if CORS_ALLOWED_ORIGINS is not set in production, there is a risk of cross-origin request forgery; ensure you configure restricted origins during deployment.
- The skill document does not clarify permission requirements or user confirmation mechanisms; if integrating the API into sensitive environments, ensure you follow the least-privilege principle and add confirmation steps.
- Static review cannot verify the skill's actual execution results; it is advisable to test critical paths (e.g., the /extract endpoint) in a real environment before adoption.
- Publisher identity is unverified, and the skill document lacks version history and changelog; when relying on this skill, be aware of clarity around maintenance responsibility and update path.
What does this skill do, and when should you use it?
This skill implements a dual REST API + MCP server for the Xberg document extraction engine, built in Rust. It constructs an Axum + Tokio server with middleware, providing REST endpoints for file upload, URL extraction, batch processing, cache stats/clear, and format listing, plus MCP endpoints for tool calls, resources, and prompts. The MCP integration allows AI agents like Claude to call extraction functions directly, including extract, extract_batch, and get_capabilities. The skill covers server setup, routing, caching strategy, error handling, and integration with Claude Desktop, with prompts designed for RAG workflows.
Builds an Axum + Tokio server with REST API (endpoints like POST /extract, POST /extract-url, GET /formats, GET /health, POST /batch, GET /cache/stats, DELETE /cache) and MCP endpoints (e.g., POST /mcp/tools, POST /mcp/tools/call). Applies middleware: body size limits (default 100MB), CORS, tracing. Implements an LRU cache keyed by SHA256 of file content (default 1000 entries). Registers MCP tools: extract, extract_batch, get_capabilities; resources: formats, features, api-reference; prompts: extract_for_rag, batch_document_processing. Supports HTTP and stdio transports. Provides environment configuration (e.g., XBERG_PORT, XBERG_ENABLE_OCR) and error handling mapping ApiError to HTTP status codes.
- Developers wanting to deploy a self-hosted document extraction API service for multiple formats (PDF, Office, images).
- AI agents (e.g., Claude) needing to extract document text and metadata directly from the agent interface via MCP.
- Teams requiring high-throughput document extraction with caching and batch processing capabilities.
- Users integrating extraction into existing backends (e.g., Rust services) via REST endpoints.
- Users standardizing RAG extraction workflows (e.g., research papers, contracts) using MCP prompts.
What are this skill's strengths and limitations?
- Provides both REST and MCP protocols, supporting a wide range of clients.
- SHA256-based LRU caching avoids re-extraction, improving performance.
- Detailed error handling with actionable remediation messages.
- Flexible configuration for size limits, feature toggles, and CORS.
- Supports async and batch processing for high-throughput workloads.
- Documentation does not specify exact build steps from the repository.
- No evidence of testing on Windows or non-Linux platforms.
- Limited number of MCP tools (only three implemented).
- Cache size is memory-bound and may not suit extremely large file libraries.
- No authentication/authorization mentioned in the environment, only basic CORS.
How do you install this skill?
Clone or fetch the xberg-io/xberg repository from GitHub. Build the project in a Rust environment (requires Rust toolchain). This skill is part of a monorepo; refer to the repository README for full collection installation. No standalone installation steps for this skill are provided.
How do you use this skill?
Start the server using the CLI from crates/xberg-cli: xberg serve --host 0.0.0.0 --port 8000. Alternatively, start the MCP server via CLI: xberg mcp --transport stdio. For Claude Desktop, add a configuration entry, e.g., {"mcpServers": {"xberg": {"command": "xberg-mcp", "env": {"XBERG_API_BASE": "http://localhost:8000", "XBERG_MCP_TRANSPORT": "stdio"}}}. Then AI agents can call MCP tools like extract. Configure environment variables like XBERG_ENABLE_OCR or XBERG_CACHE_SIZE.