Mcp Ooxml Ledger

Edit Office documents and prove no edit went unrecorded

Get it
LLM Mart 3 views 6 listing impressions
Transport
Not stated
Package
—
Registry id
io.github.Anselmoo/mcp-ooxml-ledger

No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.

An MCP server that edits Office documents and refuses to write one where an edit went unrecorded.

Before sealing a session it replays every recorded operation against the document's baseline and compares the result to what is actually on disk. A change no operation explains means the commit is refused. Of ~18 competing MCP document-editing projects, none gates the write on that check. The refusal is the product.

Setup

uv add mcp-ooxml-ledger

Add to .mcp.json (project) or claude_desktop_config.json (desktop — use an absolute path, ${CLAUDE_PROJECT_DIR} isn't expanded there):

{
  "mcpServers": {
    "ooxml-ledger": {
      "command": "uv",
      "args": ["run", "--project", "${CLAUDE_PROJECT_DIR}", "ooxml-ledger-mcp"],
      "env": { "OOXML_LEDGER_ROOTS": "${CLAUDE_PROJECT_DIR}" }
    }
  }
}

Needs uv on PATH; nothing else installed globally. Invoking the ooxml-ledger-mcp script directly gives ENOENT — it lives in the project venv, not your shell's PATH.

OOXML_LEDGER_ROOTS is the security boundary. An os.pathsep-separated list; every path any tool receives is resolved inside it and refused outside. Unset, it defaults to the server's working directory — set it deliberately, since export_receipt writes anywhere inside a root.

Tools

Tool
session open_document · close_document writes
read describe_structure · find_text read-only
edit preview_edits · apply_edits · delete_paragraph · insert_paragraph writes
seal commit_document writes · enforces the gate
stateless server_info · digest · verify · list_receipts read-only
export_receipt writes

Typical loop:

open_document → find_text → preview_edits → apply_edits → commit_document → verify

sid = open_document(document="report.docx")["session_id"]
find_text(sid, query="Q3 revenue")                     # → part, para_id, para_hash
preview_edits(sid, edits=[...], author="alice")        # → what WOULD happen; writes nothing
apply_edits(sid, edits=[...], author="alice", mode="tracked")
commit_document(sid)                                   # → refuses if anything is unaccounted for
verify("report.docx")                                  # → verified | unknown | failed

preview_edits runs the same engine function as apply_edits against a throwaway copy, so the two cannot disagree. Batches are all-or-nothing: a failing edit leaves the document byte-identical.

mode="tracked" emits Word revision marks a reviewer sees in the document. mode="direct" rewrites the text with none — still fully recorded, and the receipt discloses that a direct edit touched a revision-capable part, so it is never silently indistinguishable from an ordinary save.

Format matrix

Format Verify Edit
Word .docx Yes Yes — tracked + direct, paragraph insert/delete
PowerPoint .pptx Yes Direct only — PresentationML has no revision model, so every edit carries a mandatory disclosure
Excel .xlsx Yes No — editing verbs refuse, naming the format

Verification, digests, the gate and the receipt model are format-agnostic. Only the editing engines are format-specific: wml.py (Word) and pml.py (PowerPoint).

Read-only deployment

OOXML_LEDGER_READ_ONLY=1 leaves exactly server_info, digest, verify, list_receipts. The others aren't merely hidden — calling one answers Unknown tool. No write surface inside the roots at all.

CLI

ooxml-ledger verify report.docx    # exit 0 only when verified

No server, no session — digests the file, finds its receipt by content address, checks it. Wire it into CI or a pre-commit hook and an unaccounted-for change fails the build.

Desktop bundle (.mcpb)

From the project's README.