D — High risk signals Graded October 16, 2026Weak public adoption or transparency signals; review carefully first.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Developer tools, Files & documents
kordoc
Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff, print & layout-preserving SVG renderer
Bottom line: Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.
- Popularity score
- 36/100
- Rank
- #466 of 500
- Weekly downloads
- 44.2k
What it does
kordoc converts Korean documents (HWP, HWPX, PDF, Office formats) into Markdown with high fidelity parsing. It includes form auto-filling and side-by-side diff capabilities, available as both a CLI tool and MCP server for integration with AI agents.
Who it’s for
Teams and enterprises handling Korean-language documentation who need to extract, standardize, and version-control document content in Markdown. Builders integrating document processing into AI agent workflows, especially in East Asian markets.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Install via npm:
npm install -g kordoc
For MCP server integration with Claude Desktop, add to claude_desktop_config.json:
"kordoc": {
"command": "npx",
"args": ["kordoc", "mcp"]
}
Verify against the repo README (opens external site) for latest MCP configuration.
Risks
- Document content exposure: Processes potentially sensitive Korean documents (contracts, legal filings, personal records); ensure data residency and retention policies align with use case.
- Prompt injection via Markdown conversion: Malformed documents or embedded scripts in source files could generate problematic Markdown; validate output before feeding to LLMs.
- Supply-chain dependency: Relies on native parsing libraries for HWP/HWPX formats; updates to these dependencies may introduce parsing bugs or security gaps.
- Credential scope creep: If used in agent workflows with file system access, agents could process documents beyond intended scope without explicit access controls.
- Limited transparency on parsing internals: Korean document formats (HWP) are proprietary; full parsing algorithm transparency not guaranteed.
How to stay secure
Least-privilege permissions
- Run kordoc MCP connector with a dedicated service account; restrict file system access to a single document directory with no execute permissions.
- Disable form auto-fill features unless explicitly required; configure allowlists for permitted document types (HWP, HWPX, PDF, Office only).
- Enforce role-based access controls on the agent—ensure it cannot write to system paths, access credentials, or invoke privileged operations beyond document parsing.
- Isolate output Markdown in a sandboxed temporary directory with automatic cleanup; prevent agent from caching or exfiltrating converted documents.
Network isolation
- Deploy kordoc MCP connector on an air-gapped or restricted-egress network segment; block all outbound connections except to the calling agent.
- Use mutual TLS (mTLS) for communication between agent and connector; disable unauthenticated local IPC if multi-tenant.
- If operating in cloud environments, restrict network policies to deny inter-container/inter-service communication; whitelist only the agent's IP or subnet.
Monitoring
- Log all document processing events (file path, size, format, conversion status, errors) with immutable audit trails; alert on repeated parsing failures or timeouts.
- Monitor parsing library updates and CVE feeds for HWP/HWPX parsers; establish rapid patching procedures for supply-chain vulnerabilities.
- Track Markdown output size and entropy; flag anomalies (e.g., output much larger than input, embedded URLs, code blocks) that suggest injection attacks.
- Set resource limits (CPU, memory, timeout) on conversion tasks; alert when a single document exceeds thresholds.
Red flags to watch for
- Malformed or corrupted source documents that cause parser crashes, memory leaks, or unexpected behavior.
- Markdown output containing executable code, embedded scripts, shell commands, or LLM prompt instructions.
- Agent attempting to process documents outside the designated directory or requesting re-parsing of the same file repeatedly.
- Dependency updates without corresponding security review; parsing library versions mismatched across environments.
Alternatives
- Apache Tika — Multi-format document parser with Korean support; broader format coverage but less specialized for HWP/HWPX.
- LibreOffice headless conversion — Can convert Office/PDF to text; requires external tool setup and less Markdown-optimized output.
- Pandoc — Universal document converter; limited native HWP/HWPX support without plugins.
- LLM-based OCR + extraction — Claude/GPT-4V for document understanding; costlier per document but handles scanned/complex layouts.