llms.txt and MCP

llms.txt

what is on the site

Site documentation→llms.txt

• A static Markdown file
• Any HTTP client will do
• Read only
• Made in 15 minutes

≠

MCP

give me data and perform an action

MCP client↔MCP server

• A protocol on top of JSON-RPC 2.0
• Needs a client and a server
• Read, write and tools
• Needs server development

An optional bridge

A separate MCP server that the user gives a list of llms.txt files. An example is mcpdoc.

llms.txt→bridge server→assistant in an editor

Model Context Protocol is an open protocol that connects language models to external data and tools. Anthropic created it in November 2024. In December 2025 the protocol was donated to the Agentic AI Foundation under the Linux Foundation.

Through MCP a model can read files and databases, call APIs, run tools and get context from external sources.

	llms.txt	MCP
What it is	a file	a protocol
Format	Markdown	JSON-RPC 2.0
How it is obtained	one GET request	a session between a client and a server
What is needed	any HTTP client	an MCP client and server
What is possible	reading	reading, writing, calling tools
Risks	as with any public page	tool poisoning, prompt injection

1. Sitepublishes llms.txtGET
2. GETllms.txtsvelte.dev/llms.txt
3. Bridge servermcpdocthe user provides the list of filesMCP
4. MCPAssistantgets pages as a tool

mcpdoc (langchain-ai) is a separate MCP server. The repository is archived and no longer developed; the example below shows the principle.

1. The site publishes llms.txt

   # Svelte Documentation
   
   > Svelte is a UI framework that compiles components into efficient JavaScript.
   
   ## Docs
   
   - [Overview](https://svelte.dev/docs/svelte/overview): What Svelte is and how it works
   - [SvelteKit introduction](https://svelte.dev/docs/kit/introduction): The application framework

2. The user connects the bridge in the assistant settings

   {
     "mcpServers": {
       "docs": {
         "command": "uvx",
         "args": [
           "--from", "mcpdoc",
           "mcpdoc",
           "--urls",
           "Svelte:https://svelte.dev/llms.txt",
           "Stripe:https://docs.stripe.com/llms.txt",
           "--transport", "stdio"
         ]
       }
     }
   }

3. The assistant requests documentation

   It gets the list of links from llms.txt, loads the pages it needs and answers from fresh documentation.

Another tool of the same kind is mcp-llms-txt-explorer: an MCP server for navigating the llms.txt of any site.

MCP introduces threats a static file does not have.

Threat	MCP	llms.txt
Tool poisoning	a malicious server injects dangerous instructions	not applicable: there are no tools
Prompt injection	server data changes model behavior	possible, as on any page
Behavior change after trust	the server changes after it is connected	the file can change but performs no actions
Data exfiltration	through tool calls	not applicable

What is known about llms.txt security

Confirmed

• In the Common Crawl corpus of 584 thousand files, 10 contain a classic prompt injection and 3,793 softly steer the model.
• llms.txt performs no actions: it is text.

Not proven

• That the file is safe by itself. The proposal text has no security section; the question is discussed in the repository.

What it does not mean

• “Read only” does not mean “trusted”. An agent must treat the file content as untrusted, like any text from the network.

• An agent has to find documentation and read it: llms.txt is enough.
• A model has to perform actions or get private data: MCP is needed.
• Documentation is already described in llms.txt, and the assistant works only through MCP: a bridge fits.

Sites that have both llms.txt and material about MCP:

• mcpdoc.ru - documentation on MCP servers (llms.txt)
• n8n-mcp.ru - n8n with MCP (llms.txt)