KitchenSink4Word

KitchenSink4Word

Edit Word documents with your AI assistant: tracked changes, citations, templates, and live edits in an open document.

Your AI gets 231 actions in Word, a backup before every change, and a question instead of a guess when your request could mean more than one place.

KitchenSink4Word is an MCP server that lets Claude Code, the Codex CLI, Copilot CLI, Claude Desktop and other local MCP clients read and edit .docx files. It can also work on a document while it is open in Microsoft Word, so you watch the changes arrive. This is the free Community edition, licensed under the AGPL-3.0.

Product page · llms.txt · Changelog

Platform: Windows. Editing files works without Word installed. Live editing and the Word-powered features (PDF import and export, document compare, proofing, field refresh) need Microsoft Word.

Install

The package needs Python 3.12 or newer. Run the commands below in PowerShell or a terminal, not in an AI chat.

Claude Code or Codex CLI. Install uv, run the line for your app, and start a new session:

claude mcp add word -s user -- uvx kitchensink4word

codex mcp add word -- uvx kitchensink4word

Claude Desktop. Install uv and restart Claude Desktop. Download the .mcpb file from the latest release, then open Settings > Extensions > Advanced settings > Install extension and choose the file. The first launch downloads the Python package, so it needs a network connection.

Any other local MCP client. Use uvx as the command and kitchensink4word as its argument, or install the package and run kitchensink4word as the server command:

pip install kitchensink4word

Installing the package by itself does not connect it to an AI app; add it as a local MCP server in your client's settings.

What it can do

• Revise a report while it stays open in Word, with each edit visible as it lands.
• Read, accept and reject tracked changes, write edits as tracked changes, and work through reviewer comments.
• Fill templates, assemble chapter files into one document, and run mail merges.
• Build and format tables, lists, headings, sections and page layouts.
• Insert citations, bibliographies, footnotes, endnotes, captions and cross-references, including Zotero library citations.
• Check formatting, accessibility and document structure before you hand a file over.
• Compare two versions of a document, redact selected text, and import or export PDF through Word.

In total the server offers 115 operations in 10 tools, 231 counting each action an operation can take (for example each kind of note or table change). The whole tool list costs about 9.2k tokens of your AI's working memory at startup. Figures come from scripts/measure_surface.py and scripts/count_operations.py.

Highlights

• Table columns through merged cells. Inserting or deleting a column works correctly when the table has horizontally or vertically merged cells.
• Bulk edits in one call. Twenty cell edits are one set_cells call, not twenty round trips.
• Real tracked changes. Edit tools accept track and an author and produce Word revisions the recipient can accept or reject. With no author named, changes and comments are signed with your Office user name, the one your own Word uses, and the result's author_source says where the name came from. To sign one call as the assistant instead, pass author="assistant", which signs "AI Assistant via KS4Word".
• Word-native compare. com_multi_document with action="compare" produces a redline between two versions.
• Built not to corrupt. Saves are atomic and validated, the previous version is backed up before every change, and anything the call does not touch (equations, text boxes, content controls) passes through byte for byte. A file that is open in Word is refused with a clear message instead of a hang.
• Find and replace across split runs. Matches work even when Word has broken the text into many runs, and per-character formatting is preserved. User regular expressions run with a timeout.
• Edits you can aim. Text that matches more than once is refused with every candidate listed, so the wrong paragraph is never edited silently, and a refusal carries the next call to make.

The ten tools and context cost

The server lists ten tools, all from the first message, with nothing to switch on. Every tool except word_help takes an op (the operation to run) and args (its arguments, including the file_path of the .docx). word_help returns the arguments and a worked example for any operation, and an argument an operation does not define is refused rather than ignored. Token figures count the full tools/list entry the client receives and come from scripts/measure_surface.py.

For a recipe, ask your AI to call get_workflows. It lists 13 tasks, each with the right tool and operation for every step. Clients that load tool schemas on first use, such as Claude Code, pay close to nothing until a tool is called. The server's own instructions add about 500 tokens to the figures above.

Administrators who want a narrower server can set KS4W_READ_ONLY=1, which lists only the operations that read, or list the tools or operations to remove in KS4W_FORBID (see Configuration). What is removed no longer counts toward the cost.

Fewer permission prompts: in Claude Desktop's tool permissions for this server, set the read-only tools to Always Allow. They cannot change anything. Leave the editing tools on Ask.

Safety model

• Before every change to a closed file, the current version is copied into a hidden .ks4w-backups/ folder next to the document. Each document keeps two copies: prev.docx (the state before the most recent change) and anchor.docx (the state at the start of the session, refreshed after an hour of inactivity). Storage stays at about two copies per document no matter how many edits you make. manage_backups lists, restores and purges them, and a restore can itself be undone.
• Edits to a document that is open in Word are not part of this backup system. Word's own AutoRecover and undo cover the open document.
• Saves are atomic and validated. If an operation fails, the original file is left exactly as it was.
• Changes to the same file are serialized, within one server and across server processes, so parallel calls cannot overwrite each other.
• Deleting content that holds footnote references removes the orphaned notes, and validate checks integrity in both directions. Paragraph deletion refuses ranges that would cut a field such as a TOC in half or remove a section break by accident.
• Exclude .ks4w-backups/ from cloud sync (OneDrive, Dropbox, Google Drive). The backup files change with every edit, and sync clients can hold locks that slow saves down.
• Protection is honored. A document with an editing restriction, and a file with Windows' read-only attribute, are not edited around: the write refuses with PROTECTED and the file is left exactly as it was. set_document_protection and manage_backups stay available on a protected document, so you can lift the restriction or restore a backup.
• Snapshots before destructive operations. redact_text, resolve_revisions, prepare_for_submission, anonymize_for_review and set_document_protection keep a labeled snapshot of the file as it was, and manage_backups restores it by label.
• Refusals instead of guesses. Ambiguous targets are refused with every candidate listed, an unknown style, key or cell address is refused by name, and a call that would delete a header's pictures or tables is refused unless you say so. Each refusal is structured ({ok: false, error: {code, message, hint}}) and names the next call to make.
• Word stays yours. An encrypted file is refused before the server's hidden Word starts, so no password dialog lands on your desktop. The server ends a Word process only if it started that process itself and can prove it, never by program name, and a call that runs past its time limit answers TIMEOUT and, for a file edit, saves nothing.
• Redaction and anonymization are not guaranteed. redact_text removes the text you name from every place it can safely reach, then re-reads the saved file and reports anything left. anonymize_for_review masks self-citations and author metadata and flags the rest for you. Neither can see text inside pictures or scans, and neither can know a name you did not give it, such as initials or a nickname. Check anything sensitive yourself before you share or submit it. For legal or regulated redaction, redact the final PDF with a dedicated tool.

Privacy

The server runs on your computer. KitchenSink4AI never rece