Skip to content

SSRS2

by AntoineGou · remote · local (nuget) · no sign-in to list tools · v1.6.0 · published by GitHub user AntoineGou

Markdown to editable PowerPoint, Word, PDF; checks, edits and previews RDLC/RDL reports.

Changes · 2

6 tools: 2 change things and 4 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ssrs2 https://ssrs2.net/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "convert_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "convert_report" says "convert": a word for a change.

    What this check looks for
  • The server marks "edit_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "edit_report" says "edit": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 2Claude Code: ask
  • convert_reportConverts a report (RDL or RDLC) or Markdown (a document, or slides) with SSRS2 (Report Viewer's rules) to pptx (PowerPoint's own text boxes, tables and pictures, a slide per page: …1 finding

    Why it is in this group

    • The name "convert_report" says "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "convert_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "convert_report" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Converts a report (RDL or RDLC) or Markdown (a document, or slides) with SSRS2 (Report Viewer's rules) to pptx (PowerPoint's own text boxes, tables and pictures, a slide per page: a Markdown deck becomes a deck), pdf, docx, xlsx, mhtml, tiff, png (the first page), csv or xml. It is checked first, as validate_report checks it: with errors nothing is written. Returns validate_report's answer and written: the file's name and size, url (downloaded once, within ten minutes), curl (the command that saves it), and what it holds read back as PowerPoint (slides) or Word and a PDF reader (document) get it. help: ["answers"] says more.

    Annotations the server declares

    • title: Convert a report to a file
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • edit_reportChanges a report definition (RDL, RDLC) given as its XML by operations (the SSRS2 designer's own), all or none.1 finding

    Why it is in this group

    • The name "edit_report" says "edit": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "edit_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "edit_report" says "edit": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Changes a report definition (RDL, RDLC) given as its XML by operations (the SSRS2 designer's own), all or none. The text is patched (the rest as it was), then checked: its new problems and pages said. The answer's rdlc is the changed report (past 200 KB, url and curl: a download within ten minutes). Operations ("op"): dataset, parameter, page, header, footer, code, textbox, table, matrix, list, chart, gauge, indicator, databar, sparkline, image, barcode, subreport, line, rectangle, set, remove, space, move, swap, copy, field, column, remove_column, row, total, group, sort, widths, filter. A new item goes "after" or "before" an item or a role (role:signature), "in" a container or "at":[x, y] cm. Call help: ["textbox","set"] first: their words.

    Annotations the server declares

    • title: Change a report
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
Only reads 4Claude Code: allow
  • compare_reportsGroups report definitions (RDL or RDLC) by structure, to plan one change across many: a group's reports have the same items, datasets, parameters and code modules and differ only i…No findings

    Why it is in this group

    • The name "compare_reports" says "compare": a word for reading.
    Description, as the server wrote it
    Groups report definitions (RDL or RDLC) by structure, to plan one change across many: a group's reports have the same items, datasets, parameters and code modules and differ only in places, texts and looks, so one set of operations naming their items changes them alike. Returns groups, the largest first: structure (edit_report's structure), roles (what role:signature and the like name there), differs (how its first report differs from the first group's), places (items placed otherwise), and versions: each report and its version.

    Annotations the server declares

    • title: Group reports by structure
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • describe_reportOutlines a report definition (RDL or RDLC) to plan a change: its page, datasets and fields, parameters, and every item top to bottom with its kind, place and size in cm, what it sh…Reads private dataNo findings

    Why it is in this group

    • The name "describe_report" says "describe": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.
    Description, as the server wrote it
    Outlines a report definition (RDL or RDLC) to plan a change: its page, datasets and fields, parameters, and every item top to bottom with its kind, place and size in cm, what it shows and does (hidden, toggled, page breaks), and its role (title, table, totals, declaration, signature...), which role:signature and the like name in edit_report and validate_report whatever the report calls the item. Returns version (edit_report's baseVersion) and outline; with item, that part's XML as written, with its lines (to copy an edit's find from).

    Annotations the server declares

    • title: Outline a report
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • render_previewRenders a report definition (RDL or RDLC) or Markdown (a document, or slides: a page each) with SSRS2, the Report Viewer engine, and returns its pages as PNG, as a PDF of it would …Reads private dataNo findings

    Why it is in this group

    • The name "render_preview" says "preview": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "document": it reads documents.
    Description, as the server wrote it
    Renders a report definition (RDL or RDLC) or Markdown (a document, or slides: a page each) with SSRS2, the Report Viewer engine, and returns its pages as PNG, as a PDF of it would show them: a JSON summary first (what validate_report answers, no need to validate first; madeUpRows; conversion for Markdown, what it approximated at its lines; text, what the pages print, page by page in reading order, where values are read exactly), then an image per page, or one image of numbered thumbnails (sheet) to see a deck or a long report whole. A report with errors is not rendered. help: ["answers"] says more.

    Annotations the server declares

    • title: Render a report's pages
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • validate_reportChecks a report definition (RDL or RDLC) or Markdown with SSRS2's engine (Report Viewer's rules): XML, schema, every expression compiled, then a run with rows through every page.No findings

    Why it is in this group

    • The name "validate_report" says "validate": a word for reading.
    Description, as the server wrote it
    Checks a report definition (RDL or RDLC) or Markdown with SSRS2's engine (Report Viewer's rules): XML, schema, every expression compiled, then a run with rows through every page. Returns ok, a summary and diagnostics (code, severity, item, property, expression, line, message, hint); atRunTime counts what failed as it ran (#Error cells). Call it after each change until ok is true and atRunTime absent. Expressions are Visual Basic and may only compute (restrictedCode). Also layout, expect, variants, rowCounts and the report as it was (baselineRdlc): help: ["checks"].

    Annotations the server declares

    • title: Validate a report
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:50 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
2
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://ssrs2.net/.well-known/oauth-protected-resource
Authorization servers
https://ssrs2.net
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
yes
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 2 tools that change things (2 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://ssrs2.net/mcp: tools/list returned 6 tools to an anonymous client, including convert_report (write), edit_report (write)

    What this check looks for

Install

Pinned to version 1.6.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ssrs2 https://ssrs2.net/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ssrs2__compare_reports",
      "mcp__ssrs2__render_preview",
      "mcp__ssrs2__describe_report",
      "mcp__ssrs2__validate_report"
    ],
    "ask": [
      "mcp__ssrs2__convert_report",
      "mcp__ssrs2__edit_report"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ssrs2. Review it before you use it.

Capability tags behind 2 rules
  • mcp__ssrs2__render_preview private-data
  • mcp__ssrs2__describe_report private-data