MarkItDown: Convert Any File to Markdown for LLMs (GitHub, Scanned)

MarkItDown converts files into Markdown that a language model can read. PDF, Word, PowerPoint, Excel, HTML, CSV, JSON, XML, EPUB, Outlook messages, ZIP archives, images and audio all go in; headings, lists, tables and links come out. It is one command, markitdown file.pdf > file.md, or one Python call, and it deliberately aims at text for machines rather than a faithful copy for people. Optional hooks add Azure Document Intelligence for hard PDFs and an LLM of your choice to describe images.

It earns its place by being the lightweight option. The core install pulls in six small dependencies, each format's extras are opt-in, and the whole package is about 22,000 lines of Python. Microsoft publishes it under the MIT licence, it is one of the most-starred AI tools on GitHub, and the same repository ships an MCP server (markitdown-mcp) so Claude Desktop and other agents can convert files on request, plus a plugin system for formats the core leaves out.

• Repository: github.com/microsoft/markitdown
• Licence: MIT (MIT License)
• Language: Python. Stars: 187.2K. Forks: 13.8K. Last push: Sep 21, 2026.
• Scan: safe, Sep 21, 2026, commit b8f79c5

Who it is for

Developers feeding documents into LLM prompts or retrieval pipelines who want a quick, dependency-light converter, and agent users who want an MCP tool that turns a file or URL into Markdown.

Getting started

1. Install with every optional format (Python 3.10 to 3.14, ideally in a virtual environment)

pip install 'markitdown[all]'

2. Convert a file and save the Markdown

markitdown path-to-file.pdf -o document.md

3. Or install the MCP server for Claude Desktop and other agents

pip install markitdown-mcp

MarkItDown reads whatever the current process can read, local files and URLs alike. If the input comes from someone else, call the narrowest function (convert_local or convert_stream) rather than convert, as the README advises.

Safety scan

We cloned microsoft/markitdown at commit b8f79c5 on Sep 21, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The scan found no secrets, no pattern hits, no install hooks and no bare-IP URLs in about 22,000 lines of Python. The hosts listed are test fixtures (example.test, other.example) and the sites the converters know about, such as YouTube and Wikipedia.
• Four binaries, all test fixtures in packages/markitdown/tests/test_files: test.docx, an ordinary Word file with one image and no macros; rlink.docx, whose only external link points at file:///tmp/test_rlink.txt and exists to prove a fix for CVE-2025-11849 (a crafted document making MarkItDown embed a local file); test.epub, flagged as a JAR because an EPUB is a ZIP archive; and random.bin, 1 KB of random bytes used to check that unknown input fails cleanly.
• The real caution is by design and documented at the top of the README: convert() follows local paths, file:// and http URLs with the privileges of the process, so a service that passes user input straight to it can be made to read files or fetch internal URLs. The MCP server binds to localhost by default, has no authentication, and its README says not to expose it.
• Audio transcription uses the SpeechRecognition library's Google Web Speech call, so audio you convert is sent to Google; YouTube URLs fetch transcripts from YouTube. Everything else runs locally unless you configure Azure Document Intelligence or an LLM client.
• No lockfile, so there was nothing for the advisory check to query; the six core dependencies are unpinned. Two workflows using only GitHub's own actions, none on pull_request_target. Security policy, code of conduct and Dependabot present; no CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 22K, HTML 2,451, Markdown 1,574, TOML 317, YAML 129, Jupyter 90.

Questions

Is MarkItDown free?

Yes. MarkItDown and its MCP server are MIT-licensed and free for any use, including commercial. There is no paid tier. The optional Azure Document Intelligence and Azure Content Understanding integrations are paid Azure services billed by Microsoft, and the image-description feature costs whatever your chosen LLM provider charges; the default conversions cost nothing.

How does MarkItDown compare with Docling?

MarkItDown is light and fast: small dependencies, no models to download, good for Office files, HTML and text-heavy PDFs. Docling runs its own layout and table models, so it is heavier but much better at complex PDFs, multi-column pages and tables. Use MarkItDown for broad, quick conversion, and Docling when PDF structure really matters.

Does MarkItDown send my files anywhere?

Not by default. Conversion of documents, spreadsheets, HTML and images runs locally. The exceptions are opt-in or format-specific: audio transcription sends the audio to Google's speech service, YouTube URLs fetch transcripts from YouTube, and Azure Document Intelligence or an LLM client send content to those providers only when you configure them.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.