PDF Tools v0.13.0

PDF Tools v0.13.0

Verified extraction with replayable evidence

PDF Tools can now create a private, schema-bound extraction workspace for a
local PDF. Agents can inspect source chunks, submit one cited value at a time,
and ask PDF Tools to replay the evidence deterministically before retaining the
result.

The seven-tool workflow preserves exact PDF, schema, chunk, proposal and
workspace identities. It distinguishes exact values, calculations,
source-supported interpretations, ambiguity and not-found outcomes without
inventing a numeric confidence score. PDF Tools itself remains model-free: the
selected host decides whether and where any returned content is sent.

See docs/VERIFIED_EXTRACTION.md for the workflow and its current limits,
including no built-in OCR for raster-only evidence.

Provider-neutral signing preparation

prepare_signing_packet now returns an additive, source-bound preparation
receipt alongside its existing pending-signature result. The receipt records
the committed PDF identity, backup evidence, page geometry, signing zones,
opaque participant bindings, field-write outcomes and any readiness gaps.

This prepares local intent for a later provider integration. It does not send a
document, create a signing agreement, establish signer identity or consent, or
apply a signature. Provider execution remains a separate integration and human
authorization boundary.

Folder access and compatibility

Fresh Agent Plugin installs continue to work without a required folder
allowlist by using a private PDF Tools workspace. Optional direct-folder access
still scopes the paths PDF Tools itself may open. A host with broader access may
import a user-selected file into the private workspace.

The MCP surface is now 51 tools and 14 prompts. Existing PDF editing, form,
rendering, comparison, accessibility and folder-scope workflows remain
compatible.

Verification

The exact release line passed:

• the complete Linux gate on Node 20.19 and 22.12;
• packed runtime, native, layout and render checks on Windows;
• deterministic share and MCPB packaging on macOS arm64;
• packed macOS native rendering, mutation, accessibility, comparison and
  verified-extraction lifecycle smoke;
• zero known vulnerabilities in both production dependency projections.

The large Mac aggregate was run under severe shared-host contention and is not
described as fully green: 2,789 assertions passed before 26 timing or
process-start failures across 12 files. Every affected file subsequently passed
sequentially (177 passed, 21 intentional skips). Linux CI and the platform
release gates above are green.

This release does not make a public benchmark claim. The private extraction
campaigns established source replay and full-corpus completion for the reviewed
workflow, but were not a published comparison against Databricks, Firecrawl or
another product.

Artifacts

Artifact	Bytes	SHA-256
pdf-toolkit-mcp.mcpb	74,416,682	681e8ffd45fc14763bec8a39c7b886cca6d2068b15160b3ce2b92d3469425993
pdf-toolkit-mcp.zip	1,828,540	db60bb42ccafee32cf14e8c7e3b931f58123df3e49804809a4ea3a409ac1fbe3

Release commit:
ed7c93637bcbef1964dacb46d89446c771f2f81f.