Developer hub
Integration notes for people building workflows around the toolkit.
This page documents the machine-readable surface Paperlane exposes for developers, integrators, and agents, and the boundaries those integrations are expected to respect.
Tool capability metadata#
Each tool exposes a definition covering its input and output formats, its option schema, whether it executes locally in the browser or requires network access, and an honest statement of any known limitations (for example, tools that intentionally refuse an operation they cannot perform correctly — see Security for the Encrypt PDF example).
Agent-discovery routes#
/llms.txt provides a short, structured index of the site intended for LLM-based tools and agents to fetch quickly, including a WebMCP section listing every tool name and purpose in plain text.
/llms-full.txt extends that index with the complete tool catalog — each tool's one-line description and 40–60-word direct answer — plus the trust and support routes (this page among them), for agents that want the fuller picture in one request.
/pricing.md provides pricing information in plain Markdown, so an agent or a script doesn't need to parse rendered HTML to answer a pricing question.
/agents/webmcp.json (also served at /.well-known/webmcp.json, the community-convention path some WebMCP-aware crawlers and Lighthouse audits check) describes the browser-native WebMCP surface and lists every tool identifier without requiring an agent to scrape the visual directory.
The privacy/metadata boundary#
Document bytes and privacy-safe job metadata (which tool ran, how long it took, whether it succeeded) are kept strictly separate. If you build an integration or logging layer on top of Paperlane, preserve that boundary: never log document content, extracted text, or filenames as analytics, even for debugging.
Filenames are the one exception, and only on a tool page's own list_loaded_files WebMCP tool, which exists specifically to let an agent tell the user which files it sees loaded — document bytes are never returned by any tool, anywhere, under any name.
Rate and scope expectations#
Treat local tools as something your integration triggers inside a user's own browser session, not as a server-side batch API — local execution is intentionally tied to the user's device. Network-assisted features that do call a backend should be used at a reasonable, human-triggered rate rather than scripted in bulk.