Check us without trusting us

Checksums

SHA-256 of what the download link actually hands you. Compare after downloading, before running anything.

The source that ships with it

Five Python files, 9 967 lines. Parsed into an abstract syntax tree and scanned for network-capable imports — the same check, in effect, as grepping for requests, urllib and socket.

pdf_mcp.py:799
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

pdf_mcp.py:805
return socket.gethostbyname(socket.gethostname())

Reproduce it yourself

Four commands. No account, no tooling beyond Python, which you already have if you have any of the things this site sells.

1 · Join the two parts and hash the result

copy /b 3Q-PDF-Tool.exe.part1 + 3Q-PDF-Tool.exe.part2 3Q-PDF-Tool.exe
certutil -hashfile 3Q-PDF-Tool.exe SHA256

Expect 30ed7059afc84a6cac24ff20584cfac85e58316bc6cb5f8ac77edea3d617edac and 41 902 470 bytes. On macOS or Linux, cat part1 part2 > out.exe && shasum -a 256 out.exe.

2 · Scan the binary for hosts

python -c "import re,pathlib;b=pathlib.Path('3Q-PDF-Tool.exe').read_bytes();print(sorted({m.group(1).decode().lower() for s in re.findall(rb'[ -~]{6,300}',b) for m in re.finditer(rb'https?://([A-Za-z0-9._~-]+)',s)}))"

Expect ['schemas.microsoft.com'].

3 · Scan the shipped source for network imports

python -c "
import ast,pathlib
NET={'socket','urllib','http','ssl','requests','httpx','ftplib','smtplib','telnetlib','asyncio'}
for p in sorted(pathlib.Path('source').glob('*.py')):
    t=ast.parse(p.read_text(encoding='utf-8')); m=set()
    for n in ast.walk(t):
        if isinstance(n,ast.Import): m|={a.name.split('.')[0] for a in n.names}
        elif isinstance(n,ast.ImportFrom) and n.module: m|={n.module.split('.')[0]}
    print(p.name, sorted(m&NET) or 'none')
"

Expect none for four files and ['http','socket'] for pdf_mcp.py.

4 · Compare the zip against GitHub

python -c "
import hashlib,pathlib,urllib.request
for f in ['pdf_cli.py','pdf_mcp.py','pdf_core.py','pdf_tool.py','build_exe.py']:
    a=pathlib.Path('source',f).read_bytes().replace(b'\r\n',b'\n')
    u='https://raw.githubusercontent.com/weili02201/3q-pdf-tool/main/'+f
    b=urllib.request.urlopen(u).read().replace(b'\r\n',b'\n')
    print(f, hashlib.sha256(a).hexdigest()==hashlib.sha256(b).hexdigest())
"

All of the numbers on this page are also served as JSON, and can be read through the MCP endpoint's get_product tool under integrity.