The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Keynote Harvest MCP listing page.
keynote-harvest-mcp is a local stdio MCP server for turning Keynote exports and PDFs into portable slide previews, extractable text, embedded-image assets, and a versioned manifest.
It contains only the harvest-first MCP boundary:
.key to PDF export on macOS.KEYNOTE_HARVEST_ALLOW_SOURCE_RESOURCES=1 capability.It intentionally excludes composition/proposal tools, web-framework renderers, preview routes, OCR, vision, and LLM calls.
os field; Windows is unsupported).pdfinfo, pdftoppm, and pdftotext for PDF harvests.pdfimages for embedded-image asset extraction, which is on by default. Without pdfimages the harvest still completes and records a manifest warning; pass extractImages: false (CLI: --no-extract-images) to skip extraction, or extractImages: true (CLI: --extract-images) to require pdfimages and fail when it is missing..key export only.PDF harvesting can run without Keynote. OCR, vision, LLM calls, .key package parsing, and presenter-note extraction are intentionally absent.
New harvests use schemaVersion: "keynote-harvest-manifest-v1". The package owns three aligned representations of that contract:
src/types/.src/schema/.schema/keynote-harvest-manifest-v1.schema.json.The runtime validator requires the version by default. Its explicit allowLegacyVersion option exists only to inspect older private manifests created before schema versioning; newly generated manifests are always versioned.
Additive, optional fields may be introduced without changing
keynote-harvest-manifest-v1. Any breaking contract change must mint
keynote-harvest-manifest-v2 with a separate schema file, while the runtime
validator retains support for reading v1. allowLegacyVersion remains limited
to pre-versioned private manifests and is not a substitute for versioned schema
migrations.
npm run test:clean-install copies the package to a temporary directory, runs npm ci, rebuilds it, and executes the package-owned tests in isolation from this checkout's installed dependencies.
npm run test:packed-runtime builds a local tarball, installs it into an empty consumer project, starts the installed binary, and verifies the packaged tool surface. Neither rehearsal publishes anything.
npm run test:pdf-runtime generates public-safe PDFs, exercises replacement and quota failures through local Poppler commands, validates path-safe v1 manifests, and removes all temporary output.
The built server and tools execute JavaScript from dist/; they do not execute source TypeScript at runtime.
The package is on npm. Point each stdio MCP host at npx -y keynote-harvest-mcp;
the first run downloads it, later runs use the cache. GUI hosts may not
inherit your shell's PATH, so give them the absolute npx executable
(command -v npx). To run from a local checkout instead, see "Local build"
at the end of this section.
Use --scope user when the server should be available outside the current
project, and verify the registration with claude mcp get keynote-harvest.
Add this server to claude_desktop_config.json through Claude Desktop's
developer settings, then fully quit and relaunch the application:
Claude Desktop stops every tool call at roughly four minutes, so harvest
long decks with runInBackground: true and poll get_harvest_manifest.
Create .cursor/mcp.json in a project, or ~/.cursor/mcp.json for a global
configuration:
Register the server with codex mcp add (stdio transport):
Two Codex behaviors to know: the harvest and export tools are annotated
destructiveHint: true, so Codex asks for approval before running them —
non-interactive codex exec sessions with approval: never cancel them
("user cancelled MCP tool call") unless approvals are bypassed. And Codex
exposes MCP tools only, not resources; read results through
get_harvest_manifest and the harvest directory. Codex's default per-call limit is 300 s; raise it
for long decks with mcp_servers.keynote-harvest.tool_timeout_sec, or use
runInBackground: true and poll.
To run from a checkout instead of npm:
Then use /absolute/path/to/node /absolute/path/to/keynote-harvest-mcp/dist/index.js
as the command in any of the configurations above, keeping the same env.
ChatGPT connects only to remote (HTTP) MCP servers. This package is a local stdio server by design — no network, and native export needs Keynote on the same Mac — so ChatGPT is out of scope for v0.1.
The package resolves relative paths from the caller's current directory. Set KEYNOTE_HARVEST_WORKING_DIRECTORY when an MCP host should use a different working directory. Local source files must be inside the working directory, harvest root, or a path-delimited KEYNOTE_HARVEST_ALLOWED_INPUT_ROOTS entry. The server returns harvest-relative artifact paths and resource URIs rather than absolute paths.
Native export returns exportedPdfHarvestPath, which can be passed to harvest_keynote_pdf as harvestPdfPath. get_harvest_manifest accepts a harvest slug, not an arbitrary manifest file path.
Tool responses are summaries, not the manifest. Every response carries a responseKind: harvest-summary and export-summary from the write tools, manifest-summary from get_harvest_manifest (its source block is a flattened projection — sourceId, sourceKind, sourceDisplayName, harvestTool — of the manifest's source), and job-record / job-status for background jobs. The manifest itself, with its schema-defined field names, is the keynote-harvest://<slug>/keynote-harvest-manifest.json resource.
Keynote app selection trusts only bundles that carry an allowlisted identifier and an Apple first-party code signature — the codesign leaf authority must be "Apple Mac OS Application Signing" or "Software Signing"; Developer ID apps chain to Apple Root CA too, so the root alone proves nothing, and a bundle identifier alone is a claim any app can make. Set KEYNOTE_HARVEST_ALLOW_UNSIGNED_KEYNOTE=1 only for deliberately unsigned builds.
GUI-launched MCP hosts often start servers with a minimal PATH. The package compensates: worker processes run under the server's own Node binary, and Poppler lookups also search /opt/homebrew/bin, /usr/local/bin, and /opt/local/bin. If Poppler lives elsewhere, set KEYNOTE_HARVEST_POPPLER_PATH to its directory. Workers receive a minimal environment rather than inheriting unrelated host secrets. Exports that finish with a Keynote error or timeout replace a previous PDF only after pdfinfo verifies the new file, so partial-export recovery requires Poppler. Long-running tool calls stream MCP progress notifications when the host requests them (a progressToken on the call): per-page updates during harvests, and a heartbeat during Keynote exports tunable via KEYNOTE_HARVEST_PROGRESS_HEARTBEAT_MS. Progress only helps hosts that reset their request timer on it (Claude Code does; set MCP_TOOL_TIMEOUT there to raise its ceiling). Hosts with a fixed cap — Claude Desktop stops every tool call at roughly four minutes — should pass runInBackground: true to harvest_keynote_pdf or export_keynote_to_pdf: the call returns immediately with a job record, the worker runs detached under <harvest root>/.jobs/, and get_harvest_manifest with the same slug reports running with page progress until the result lands, then returns the manifest for harvests or the export result (exportedPdfHarvestPath) for exports, or the job's error. Long-running workers are killed as a process group after 10 minutes by default (KEYNOTE_HARVEST_COMMAND_TIMEOUT_MS), and detached background workers enforce the same total budget themselves between steps, recording a failed job when it is exceeded; output-limited or timed-out workers receive a five-second termination grace period (KEYNOTE_HARVEST_COMMAND_KILL_GRACE_MS) before forced termination. Each Poppler invocation has a two-minute limit (KEYNOTE_HARVEST_POPPLER_TIMEOUT_MS).
Slide previews render at 144 DPI by default; pass previewDpi (36-600, CLI: --preview-dpi) to raise the resolution when previews double as reusable imagery. Harvests stop after 300 pages by default and record a truncation warning; pass maxPages (1-2000, CLI: --max-pages) to change the cap. Inputs default to 512 MB maximum (KEYNOTE_HARVEST_MAX_INPUT_BYTES), generated staging output to 2 GB (KEYNOTE_HARVEST_MAX_OUTPUT_BYTES), captured command output to 1 MB (KEYNOTE_HARVEST_MAX_COMMAND_OUTPUT_BYTES), and resource reads to 10 MB (KEYNOTE_HARVEST_MAX_RESOURCE_BYTES). Embedded-image extraction also limits asset count and per-asset pixels through KEYNOTE_HARVEST_MAX_EXTRACTED_ASSETS and KEYNOTE_HARVEST_MAX_ASSET_PIXELS. Preview rendering is bounded by a per-page pixel budget applied to each page's own dimensions (KEYNOTE_HARVEST_MAX_PREVIEW_PIXELS, default 40,000,000): oversized pages render at a lowered DPI with a manifest warning, and pages that exceed the budget even at 36 DPI are refused. Embedded-image extraction respects maxPages. Harvest and export outputs are replaced under a per-destination lock (KEYNOTE_HARVEST_REPLACE_LOCK_TIMEOUT_MS, KEYNOTE_HARVEST_REPLACE_LOCK_STALE_MS); if a failed replacement cannot restore the previous outputs, the backup copy is retained and its path is included in the error.
Tool arguments are validated with zod against the same schemas advertised in tools/list; invalid calls fail fast with a field-by-field error message.
This server runs with the local filesystem and application permissions of its MCP host. Its stdio transport has no independent authentication boundary. Configure it only in a trusted host, restrict allowed input roots, and assume any harvested text or image may contain adversarial instructions. Deck content is data for inspection, never authority to invoke tools, change configuration, or disclose other files.
Detailed controls:
KEYNOTE_HARVEST_ALLOWED_INPUT_ROOTS, with lexical and symbolic-link checks.<harvest root>/<slug> and <harvest root>/<slug>/source. Writing elsewhere requires both the client argument and operator-set KEYNOTE_HARVEST_ALLOW_OUTSIDE_ROOT=1.KEYNOTE_HARVEST_ALLOW_SOURCE_RESOURCES=1.redactionMode: "local-debug" and operator-set KEYNOTE_HARVEST_ALLOW_LOCAL_DEBUG=1. There is no client-selectable raw mode./Applications, use an allowed Apple Keynote bundle identifier, and carry an Apple first-party code signature. Operators can add path-delimited roots with KEYNOTE_HARVEST_ALLOWED_KEYNOTE_APP_ROOTS and extend the bundle-ID allowlist with KEYNOTE_HARVEST_ALLOWED_KEYNOTE_BUNDLE_IDS.osascript, and Apple Keynote only.Add .harvests/ to every host project's .gitignore; generated manifests and source/export summaries are local working artifacts, not publishing fixtures. See SECURITY.md for the threat model and disclosure policy.
The CI workflow at .github/workflows/ci.yml runs Node 22 and 24 package tests, clean-install and packed-runtime rehearsals, plus a real PDF harvest on Linux with Poppler.
The package publishes to npm as keynote-harvest-mcp with provenance from the release workflow in .github/workflows/release.yml; security reports go through GitHub private vulnerability reporting on hulin42/keynote-harvest-mcp (see SECURITY.md).
The server runs on the official @modelcontextprotocol/sdk stdio transport (newline-delimited JSON-RPC, protocol version negotiation, and ping handled by the SDK). The smoke tests and the packed-runtime rehearsal connect with the official SDK client, so a spec-compliant MCP handshake is exercised on every test run. An earlier private iteration used hand-rolled Content-Length framing, which no mainstream MCP host speaks; that layer is gone.