Docfarm

Name: Docfarm MCP Server
Availability: InStock
Author: Docfarm

HIPAA CompliantSOC2 ReadyISO 27001 Ready

Productivity21 tools

Publish a document to a public web link from an AI agent, patch it in place, and read who viewed it. 21 tools verified live, 12 of them writes. One OAuth scope, no read-only grant.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 23 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Docfarm via MCP

https://mcp.doc.farm/

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Docfarm Tools & Capabilities (21)

whats_possibleRead-only

Show a grouped overview of everything docfarm can do for the user — reading, editing, sharing, tracking, drafting follow-ups, and collaborating. Call this when the user asks 'what can you do?', 'what does docfarm do?', 'show me what's possible', 'help', or similar capability questions. Cheap and self-contained — no doc lookup needed.

list_docsRead-only

List the docs the user OWNS in their docfarm. For docs other people have shared WITH the user, use `list_shared_with_me`.

get_share_linkRead-only

Share URL for a doc.

get_doc_statusRead-only

Viewing stats for a doc.

track_html_pageActs

Register a page the USER ALREADY HOSTS elsewhere (their website, Webflow, etc.) for visitor tracking — returns a script tag to paste into the page's <head>. Use `host_html_content` instead when docfarm should be the host.

get_tracking_snippetRead-only

Tracking snippet for an HTML doc.

update_doc_settingsDestructive

Update sharing settings for a doc the user OWNS: password protection (password_on / password_value), ask viewers for their name before viewing (ask_name), allow file downloads (allow_downloads), and view notifications for the owner (notify). Only the fields you pass are changed.

rename_docDestructive

Rename a doc the user OWNS — changes its display title only. The share link/slug is intentionally left unchanged so existing recipients' URLs keep working. Identify the doc via `doc_name` (fuzzy-matched) or `slug`.

delete_docDestructive

Permanently delete a doc the user OWNS — removes the document, its share link(s), all view/analytics data, chat, comments, suggestions, collaborators, and the stored file. IRREVERSIBLE. Only the owner can delete. Confirm with the user before calling if there's any ambiguity. Identify the doc via `doc_name` (fuzzy-matched) or `slug`.

invite_collaboratorDestructive

Invite someone to collaborate on a doc the user OWNS, by email, so it lands in their docfarm. If they're already a docfarm user the doc appears in their farm immediately; if not, they get an invite email with a signup link. REQUIRES the collaborator's `email` AND `allow_overwrite` (true = their edits overwrite the original; false = their edits fork into a copy they own, auto-shared back to the inviter). If you don't have the email, ask for it. If the user hasn't said whether the person should edit directly or only make a copy, ask before calling — don't guess. Identify the doc via `doc_name` (fuzzy-matched) or `slug`.

draft_followupRead-only

Viewing data for a doc to draft a follow-up email.

host_html_contentDestructive

Host an HTML doc on docfarm and return its share link. A new name creates a new doc; a name matching an existing doc overwrites that doc in place, keeping its share link, password, and view stats, so anyone holding the URL sees the new version. Reuse the exact name to update a doc and change the name only to create a separate one. Takes the HTML inline, so it works in any environment. For a small change to an existing doc, `get_doc_html` + `patch_doc` sends far less content.

duplicate_docActs

Server-side copy of any HTML doc the user can read (their own OR shared with them) into their own farm under a new name. THE fast path for building a modified version of an existing doc: content never passes through your context — duplicate in ~1s, then use patch_doc for the differences. Vastly faster than get_doc_html + re-hosting.

get_upload_urlActs

Step 1 of 2 for hosting a large HTML file that is already on disk, without sending its bytes through the model's context. Returns a short-lived signed upload URL; upload the file to it with a direct HTTP PUT (Content-Type: text/html), then call `finalize_upload` with the returned upload_path and a doc name. Requires a shell and unrestricted outbound HTTP, so the PUT will not succeed where outbound network access is restricted; `host_html_content` accepts the HTML inline and works in any environment.

finalize_uploadDestructive

FAST PATH step 2/2: after PUTting the file to the signed URL from `get_upload_url`, call this to publish. NEW name → new doc + share link. Name matching an EXISTING HTML doc → updated in place, same share link. Verifies the uploaded object exists before publishing.

get_doc_htmlRead-only

Read the current HTML body of any docfarm HTML doc the user has access to — their own docs OR docs other people have shared with them (as collaborator or via share link). Returns title, share URL, the caller's role (owner / collaborator / reader), and the full HTML. ESSENTIAL precursor to `patch_doc`: call this first whenever the user asks for any change to a doc you don't have in context, so you can see what's there and construct accurate before/after snippets. Pass `doc_name` (easiest, fuzzy-matched) or `slug`. Embedded base64 images are stripped to placeholders by default (huge docs become readable in one call), so hosting a stripped copy back would drop those images from the doc; edit via patch_doc, or re-fetch with strip_data_uris: false for the byte-exact original. Large docs page via offset/max_chars — the response tells you the offset for the next slice.

get_doc_urlRead-only

Get a time-limited signed URL that downloads the raw file of any doc the user has access to — HTML, PDF, Markdown, anything stored on docfarm. Use this when you need to hand the file off to another tool or LLM, when the user asks for a download link, or when the doc isn't HTML (where get_doc_html doesn't apply). URL expires after `ttl_seconds` (default 3600, max 86400).

patch_docDestructive

Edit an existing hosted doc by replacing a snippet of its HTML. DEFAULT TOOL for ANY edit to a doc the user already has — typo, copy change, restyle, new section, anything. ~50 tokens instead of ~7000 for re-hosting. Workflow: (1) if you don't have the current HTML in context, call `get_doc_html` first to read it. (2) construct `before_snippet` as a unique chunk of the existing HTML and `after_snippet` as its replacement. Pass EITHER `doc_name` (easiest) OR `slug`. Ambiguous match → fails with context for each candidate. Preserves share link, password, view counts, comments. Patching sends only the changed snippet, so it costs far less than re-sending a whole doc, and `patch_doc_batch` covers even large rewrites.

patch_doc_batchDestructive

Apply several patch_doc edits to one doc atomically — either all patches land or none do. Use for multi-region edits ("fix the typo AND change the CTA AND update the date") and for any change big enough to need multiple patches. Same workflow as patch_doc: call get_doc_html first if you don't have the HTML, then send a batch of before/after pairs. Identify the doc via `doc_name` or `slug`.

list_shared_with_meRead-only

HTML docs other docfarm users have added the caller to as a collaborator. Each entry also notes how patch_doc behaves (overwrite vs fork-on-edit) and points at any fork the caller already owns.

propose_editDestructive

Send a suggestion to the owner of a doc the user collaborates on, instead of changing the doc directly. Use mode "comment" to pass along free-form feedback for the owner to act on, or mode "fork" to copy the doc and apply a snippet edit in that copy. Use this when the user wants to suggest a change rather than make one; `patch_doc` is the tool for actually applying an edit.

Read from the server on 2026-08-23, including each tool's own safety annotations.

Limits

One OAuth scope covers everything. The server's RFC 9728 descriptor advertises scopes_supported holding the single value docfarm — one string naming no verb and no object. It cannot exclude anything: granting it grants the whole surface, including delete_doc, now and after any future tool is added. No boundary falls between the routine write and the irreversible one. The server's per-tool destructiveHint annotations are the only signal a client can act on, and they are advice to the client, not enforcement at the grant.
Publishing has no confirmation step of its own. host_html_content returns a live public URL on the first call. Docfarm's connect page states reading tools are marked read-only so they run without confirmation "while anything destructive like deleting a doc always asks first" — that behaviour comes from the client honouring the annotation, not from the server refusing.
Reusing a document name overwrites the published document. That is host_html_content's documented default, and finalize_upload behaves the same way. The previous version is not recoverable through any listed tool; there is no version history or undo in this surface.
Free-tier documents expire after 30 days. Docfarm's pricing page states free hosting lasts 30 days. A link an agent generated and you forwarded stops resolving after that unless the account is on Pro, which the same page marked as coming soon on 2026-08-23.
Docfarm holds no security certification of its own. Its security page states plainly that Docfarm "is an early-stage product" without its own SOC 2 attestation or ISO 27001 certificate, and that formal attestation is on the roadmap. The certifications it lists — SOC 2 Type 2 and ISO 27001 — belong to Vercel, Supabase and Anthropic as subprocessors.
The published vulnerability-disclosure link is dead. Docfarm's security page links its disclosure policy to github.com/lavanry/docfarm/blob/main/SECURITY.md; that repository returned 404 to both the web and the GitHub API on 2026-08-23. The email route, hello@doc.farm, is stated to acknowledge reports within 48 hours.
Two endpoints exist for one server. Docfarm's llms.txt names https://docfarm-mcp.vercel.app/mcp while the directory and the connect page name https://mcp.doc.farm. Both served byte-identical tool lists on 2026-08-23, but the Vercel hostname is the deployment's internal name and should not be treated as a documented endpoint.
No usage or rate-limit figures are published. Docfarm's security page says write endpoints are rate-limited and its privacy policy names Upstash as the rate-limiting processor, but no numeric limit, retry header or 429 behaviour is documented anywhere we could find.
Domain restrictions exist in the product but not in the connector. Docfarm's terms list access control "via passwords, email gates, and domain restrictions"; update_doc_settings exposes only password, name-gate, downloads and notifications. Domain restriction appears to be a web-app-only control.
whats_possible returns marketing-shaped capability copy. It is a self-describing overview tool, not a data tool; the same text is served in the server's initialize instructions.

Frequently asked questions

Yes, and that is the product. Publishing a doc mints a share link that anyone holding the URL can open, and Docfarm's own machine-readable index documents an unauthenticated endpoint that returns an open doc's HTML as plain text. Password and email gates exist but are off unless a separate tool turns them on.

Twenty-one, read live from the server on 2026-08-23 without signing in. Anthropic's directory lists 22 because it still carries read_shared_doc, a name the running server no longer serves. Nine tools declare themselves read-only and twelve are writes, of which nine carry a destructive hint.

Yes, through one tool. Invite collaborator takes an email address and, where that address has no Docfarm account, the service sends it an invitation with a signup link. Docfarm's terms name Resend among its subprocessors. The tool requires the address and a permission flag, and the server instructs the model to ask rather than guess.

One scope named docfarm, and it separates nothing. The server's RFC 9728 descriptor advertises that single value across the whole surface, so consent cannot grant reading a document without also granting deleting one. There is no read-only grant and no boundary between patching a doc and permanently destroying it.

No, at the time of checking. Docfarm's terms state the platform is currently provided free of charge, and its pricing page shows a free tier at zero euros against a Pro tier at 10.99 euros per month marked as coming soon. No tool call spends credits, and no tool reports a balance or quota.

Sometimes directly, otherwise into a copy. The server states that a patch to a doc you do not own lands on the owner's doc when the owner allowed direct overwrite, and otherwise forks automatically into your own copy, with the original owner added to that fork as a collaborator. The permission is set when the collaborator is invited.

No. Docfarm's pricing page limits free-tier hosting to 30 days, so a share link an agent generated and you forwarded stops working after that window unless the account is on a paid plan. The Pro tier is what makes a farm permanently queryable, and its checkout was still listed as coming soon.

Yes, and that reaches third-party personal data. Docfarm's privacy policy states the sharer can see that a document was viewed, which pages were read and for how long, and that viewers may be asked for a name or email that is then passed to the sender. Three tools surface that data to the model.