PCO
pco drives a Mathpix Private Cloud OCR deployment running in your owninfrastructure. It speaks the same document API as scs, plus the deployment-only endpoints
for jobs over a cloud folder, status, and usage.
Point
--endpoint at your deployment. A deployment usually needs no credentials of its own; pass--token or the client-certificate flags if your ingress requires them. Set the endpoint once withmpx configure (or MPX_ENDPOINT) to avoid repeating it.convert
mpx pco --endpoint http://pco.internal:8080 convert paper.pdf paper.mmd --formats docx
mpx pco --endpoint http://pco.internal:8080 convert ./scans/ ./out/ --formats md
mpx pco --endpoint http://pco.internal:8080 convert s3://acme-docs/scans/ --formats md
A file or a local folder is sent to the deployment and the outputs are written locally. A cloud
folder (
storage; the outputs land in your bucket. Every converted document yields
synchronous
folder (
s3://, gs://, or an Azure blob URL) becomes a server-side job over the deployment’s ownstorage; the outputs land in your bucket. Every converted document yields
mmd and lines.json;--formats adds conversion formats on top. A single image is OCR’d through the deployment’ssynchronous
/v3/text automatically.status and usage
mpx pco --endpoint http://pco.internal:8080 status # versions, workers, license and metering
mpx pco --endpoint http://pco.internal:8080 usage --from 2026-09-01 --to 2026-09-30
mpx pco --endpoint http://pco.internal:8080 usage --export # signed statement for an airgapped deployment
jobs
Manage server-side batch jobs over a folder in your bucket:
mpx pco --endpoint http://pco.internal:8080 jobs list
mpx pco --endpoint http://pco.internal:8080 jobs get JOB_ID
mpx pco --endpoint http://pco.internal:8080 jobs files JOB_ID --status error
mpx pco --endpoint http://pco.internal:8080 jobs report JOB_ID
mpx pco --endpoint http://pco.internal:8080 jobs retry JOB_ID
mpx pco --endpoint http://pco.internal:8080 jobs cancel JOB_ID
Connecting
Transport flags on the
pco service, layered on top of the global app_id / app_key:| flag | for |
|---|---|
--endpoint |
the deployment URL (or MPX_ENDPOINT, or mpx configure) |
--token |
a bearer token your ingress expects, sent as Authorization |
--ca-cert |
the CA that signed the deployment’s certificate |
--client-cert, --client-key |
a client certificate for mTLS |
--insecure |
skip TLS verification (self-signed test deployments) |
Every command has
--help for its full set of flags.