---
name: review-document-ocr
description: Review GuGuData image OCR and document-processing API integrations. Use when a pull request changes multipart uploads, supported document formats, OCR result handling, PDF parsing, document conversion, generated-file handling, or related error and privacy controls.
---

# Review Document OCR

Review OCR and document-processing integrations against published GuGuData API contracts without exposing repository or customer documents.

## Target Users

- Application developers integrating image OCR or PDF extraction
- Backend engineers reviewing multipart upload and conversion flows
- Security and privacy reviewers checking document handling

## Invocation Boundary

- Inspect code and published contracts by default.
- Never upload repository files, customer documents, private documents, or production data.
- Invoke a processing API only when the user explicitly authorizes a non-sensitive test fixture and accepts credit consumption.
- Do not buy plans, manage keys, change accounts, delete files, or write to external storage.
- Do not claim extraction accuracy without a user-approved representative evaluation set.

## Read-Only Tools

Inspect the published contracts for these document-processing operations:

- `postOcr`
- `postPdf2text`
- `postPdf2format`
- `postPdfSummary`
- `postOcr2word`
- `postPdf2word`

Confirm request and response shapes in `https://gugudata.io/.well-known/openapi.json`. Use `https://gugudata.io/llm.md` for human-readable discovery. Use `https://mcp.gugudata.io/mcp` only for account-authorized discovery and explicitly approved non-sensitive test calls.

## Review Workflow

1. Identify which upload, extraction, summary, or conversion operation the change uses.
2. Verify the HTTP method, content type, multipart field names, filename handling, and documented file formats.
3. Verify whether the response is JSON, text, or a generated file before reviewing parsing and storage logic.
4. Check size limits, timeouts, retry safety, cancellation, and cleanup paths.
5. Check handling for `400`, `401`, `403`, `429`, `5xx`, malformed files, and empty results.
6. Check that logs and error messages do not expose document contents or credentials.
7. Report contract mismatches separately from privacy or reliability risks.

## GitHub Code Review Example

User request:

> Review this pull request with `$review-document-ocr`. It adds PDF-to-text upload handling. Do not upload any repository fixture.

Expected review behavior:

- Compare the multipart request and response parsing with `postPdf2text` in the published OpenAPI description.
- Flag any document content, authorization value, or generated download URL written to logs.
- Verify bounded timeouts and safe handling of unsupported or empty files.
- Write actionable GitHub comments with file paths, line references, evidence, and a proposed fix.

## Output

Return findings ordered by severity. For each finding include the affected file, contract or privacy evidence, user impact, and smallest safe fix. End with checks performed and checks skipped.