English Français العربية

HiddenContent

Official registry Productivity

Check a document for hidden text before your agent reads it. PDF, Office, RTF, HTML.

Source code Website

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http hiddencontent 'https://api.hiddencontent.ai/v1/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "hiddencontent": {
            "type": "http",
            "url": "https://api.hiddencontent.ai/v1/mcp"
        }
    }
}
NPM package @hiddencontent/mcp
Claude Code 
claude mcp add hiddencontent -e 'HCS_API_TOKEN=<your hcs_api_token>' -e 'HCS_URL=<HCS_URL>' -e 'HCS_CAPABILITIES=<HCS_CAPABILITIES>' -- npx -y @hiddencontent/mcp@0.4.15
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "hiddencontent": {
            "command": "npx",
            "args": [
                "-y",
                "@hiddencontent/mcp@0.4.15"
            ],
            "env": {
                "HCS_API_TOKEN": "<your hcs_api_token>",
                "HCS_URL": "<HCS_URL>",
                "HCS_CAPABILITIES": "<HCS_CAPABILITIES>"
            }
        }
    }
}

Environment variables

  • HCS_API_TOKEN required secret API token for the HiddenContent service. Get one at https://hiddencontent.ai/start?ref=mcp-registry — the server refuses to start without it and says so.
  • HCS_URL Base URL of the service. Defaults to the hosted API; set it only when pointing at a self-hosted instance.
  • HCS_CAPABILITIES Comma-separated list of what your agent can actually do. The only accepted values are `tool-use`, `network-egress` and `code-execution`. These turn on the checks for concealed text that instructs a model to call a tool, send data or run code — declaring more can raise severity and never lowers it, and declaring nothing leaves those checks inert. Defaults to `tool-use` in the bundle install.
MCPB package https://github.com/AeroSpark-ai/hiddencontent-mcp/releases/download/v0.4.15/hiddencontent.mcpb

Environment variables

  • HCS_API_TOKEN required secret API token for the HiddenContent service. Get one at https://hiddencontent.ai/start?ref=mcp-registry — the server refuses to start without it and says so.
  • HCS_URL Base URL of the service. Defaults to the hosted API; set it only when pointing at a self-hosted instance.
  • HCS_CAPABILITIES Comma-separated list of what your agent can actually do. The only accepted values are `tool-use`, `network-egress` and `code-execution`. These turn on the checks for concealed text that instructs a model to call a tool, send data or run code — declaring more can raise severity and never lowers it, and declaring nothing leaves those checks inert. Defaults to `tool-use` in the bundle install.

Frequently asked questions

What is HiddenContent?

Check a document for hidden text before your agent reads it. PDF, Office, RTF, HTML.

How do I install HiddenContent?

It runs as a remote server. In Claude Code: claude mcp add --transport http hiddencontent 'https://api.hiddencontent.ai/v1/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does HiddenContent need an API key?

Yes. It expects HCS_API_TOKEN, which you set in its configuration.

Is HiddenContent open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains HiddenContent?

It is published by AeroSpark-ai. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.