This server treats every input document as untrusted, and so does the DeckProbe engine behind it: nothing is rendered, no macro runs, no external reference is resolved, and no network connection is opened.

Report suspected vulnerabilities privately through GitHub Security Advisories.

• A flaw in this server — path handling, the allow-list, the deadline, argument construction, result mapping — goes to deckflow/deckprobe-mcp-server.
• A flaw in document parsing itself goes to deckflow/deckprobe, which owns the engine.

If you are not sure which, report it to deckflow/deckprobe-mcp-server and it will be routed.

Do not open a public issue containing exploit documents, private files, passwords, or customer data.

Only the latest published minor version receives security fixes.

Two settings matter when this server runs anywhere other than one person's machine:

• DECKPROBE_MCP_ROOTS pins the directories the server may read. It is unrestricted by default, which matches a local user who could run the CLI themselves; set it for shared, hosted, or automated deployments. Paths are symlink-resolved before the check.
• DECKPROBE_MCP_TIMEOUT_MS is the hard deadline after which an engine process is killed. The engine's own wall-clock budget normally fires first; this is the backstop.

Report values — a document title, an author, an application name — are attacker-controlled strings. This server passes them through as JSON data and never interpolates them into instructions. Anything consuming a report should treat them the same way.