Field-by-field comparison
Compare the evidence before choosing an MCP.
Each signal stays separate, missing facts remain visible, and the column order follows your selection.
| Evidence field | Citra (PDF Reader MCP)Shortlist candidate | Codebase Memory MCPMCP100 Recommended |
|---|---|---|
| Task fit | ||
| Best for |
|
|
| Not ideal for |
|
|
| Avoid when |
|
|
| Provenance | ||
| Provenance details | First-party MCP SylphxAI · Publisher source ↗ | First-party MCP DeusData · Publisher source ↗ |
| Maintenance | ||
| Maintenance details | Repo: Aug 8, 2026 Package: Aug 7, 2026 | Repo: Aug 14, 2026 Package: Aug 14, 2026 |
| Popularity evidence | ||
| GitHub stars | 891 GitHub stars · checked 2026-08-14T18:46:26.000Z | 44,904 GitHub stars · checked 2026-09-25T18:35:00Z |
| Package downloads / 30 days | No reliable download data | 28,000 package downloads / 30 days · checked 2026-08-14T00:00:00.000Z |
| Shared-package downloads / 30 days | 1,062 shared-package downloads / 30 days (not MCP-specific) · checked 2026-09-08 | Not documented |
| External adoption evidence | Not documented |
|
| Client coverage | ||
| Client coverage details | Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio | Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio |
| Client coverage note | Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server. | |
| Access and data | ||
| Authentication | Default stdio needs no service credential. Optional HTTP mode supports MCP_API_KEY and binds loopback by default; configured HTTP or OpenAI-compatible visual providers may use their own headers or API key, while local command providers do not inherently require one. | local stdio; no remote auth needed |
| Cost | The MIT-licensed local server has no documented usage fee. Pricing for any operator-selected external OCR, visual, network, or client provider is outside the Citra documentation and remains provider-specific. | none beyond local resources |
| Permissions | The tools read PDF paths and URLs available to the process. Directory allowlists can restrict local reach; URL handling blocks private addresses by default unless the operator overrides it. | reads indexed source/project data; installer writes supported agent/editor configs/hooks |
| Data handling | Default stdio processing is local. Optional OCR or visual providers may receive rendered content according to their configuration, and URL inputs are fetched from their source. | local processing; current docs state no source/index/query/env/telemetry upload |
| Limitations | ||
| Tradeoffs |
|
|
| Risk context | Use stdio, configure explicit allowed PDF directories, retain private-IP URL blocking, require an API key before any non-loopback HTTP deployment, and review native artifacts before installation. | latest 0.10.x supported; SLSA/Sigstore/checksums/VirusTotal/security policy |
| Evidence date | ||
| Editorial review | 2026-08-14 | 2026-09-23 |
| Candidate evidence | 2026-08-14T18:46:26.000Z | 2026-09-25T18:35:00Z |
Popularity, maintenance, fit, permissions, and client support are independent evidence fields.
Read the evidence method →