ReviewMCP Server

You run a minimal MCP server that validates Re:VIEW markup, fixes IDs, runs quick lint checks, and builds PDFs using a hybrid JavaScript and Ruby pipeline. This server is designed to be simple to install and integrate with your Re:VIEW projects, while providing a secure, SSOT-aware workflow for tag enforcement and mapfile handling.

How to use

You use the MCP server by connecting your MCP-enabled client to the local stdio server configuration. Start the server in your project environment and point your client to the appropriate command so it can process Re:VIEW documents through the hybrid pipeline. The server exposes commands to validate tags, plan and apply ID fixes, run fast linting, preprocess content, build PDFs, and validate security configurations.

How to install

Prerequisites you need on your machine are Node.js 18+ and Ruby with Bundler, plus a Re:VIEW installation compatible with your workflow.

# Clone the MCP server repository
git clone https://github.com/dsgarage/ReviewMCP.git
cd review-mcp-min

# Install dependencies
npm install

# Build TypeScript sources
npm run build

# Start the MCP server
npm start

Configuration and usage notes

The MCP server supports a lightweight security configuration that loads dynamically and performs pre-sanitization followed by final Ruby validation. It blocks path traversal for mapfile macros, validates file sizes and extensions, and enforces tag allowlists for Re:VIEW documents.

Optional configuration can be provided via a JSON file to tailor the server profile to your project. Example:

{
  "profile": "dual",
  "target": "latex",
  "blockOnUnknownTags": true,
  "autoFixIdsOnSave": true
}

Development and testing

If you are contributing or testing the hybrid pipeline, you can run development tools, perform type checking, build the project, and run the test script that generates a PDF to verify the end-to-end flow.

# Run in development mode
npm run dev

# Type checking
npm run typecheck

# Build
npm run build

# Test PDF generation
node test-build.js

Security and SSOT concepts

The server emphasizes SSOT by loading dynamic security configurations and applying a two-layer defense: pre-sanitization at the MCP layer and final Ruby-based validation. It includes explicit checks for mapfile path safety and ensures only supported tags and safe file types are processed.

Key security checks include validation of mapfile paths and blocking unsafe access to mapfile macros, along with size and extension validation to prevent risky inputs.

Usage notes for clients

To integrate with a Claude Desktop or ClaudeCode workflow, you configure an MCP server entry that specifies how to start the local MCP instance. The following examples show how to invoke the MCP server locally using Node and the project’s entry point.

Available tools

review.version

Get the Re:VIEW CLI version currently installed so you can verify compatibility with your project.

review.tags.list

List the allowed Re:VIEW tags that may be used in your documents.

review.enforceTags.check

Check for unknown or disallowed tags in your Re:VIEW source to enforce tag policies.

review.fixIds.plan

Plan fixes for empty or duplicate IDs in blocks and captions so you can review changes before applying.

review.fixIds.apply

Apply ID fixes and create a backup of the original content for safety.

review.lint

Run fast lint checks to surface obvious markup issues prior to full builds.

review.preprocess

Perform JavaScript preprocessing as part of the hybrid pipeline (currently passthrough).

review.build-pdf-hybrid

Build a PDF using the hybrid pipeline that combines JS preprocessing with Ruby-based LaTeX generation.

review.check-ruby-extensions

Verify the Ruby extensions required for PDF generation are available and compatible.

review.test-mapfile

Test mapfile handling with security validations to ensure safe macro usage.

review.security.config

Get or inspect the current security configuration used by the MCP server.

review.security.validate-mapfile

Validate mapfile paths against security rules to prevent path traversal.

review.security.compare

Compare security configurations to ensure SSOT compliance across environments.