br.com.signdocs/mcp-server
NPM · @SIGNDOCS-BRASIL/MCP-SERVER · 2 COMPONENTS · SCANNED SEP 20
Assinatura eletrônica no Brasil (ICP-Brasil): envie, assine e verifique com sua conta SignDocs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 97 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 12 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2607 tokens (~96/item across 27 items; 24 tools + 3 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 86% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the br.com.signdocs/mcp-server server?
br.com.signdocs/mcp-server runs locally as an npm package, launched with npx -y @signdocs-brasil/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @signdocs-brasil/mcp-server
claude mcp add br-com-signdocs-mcp-server -- npx -y @signdocs-brasil/mcp-server
{
"mcpServers": {
"br-com-signdocs-mcp-server": {
"command": "npx",
"args": [
"-y",
"@signdocs-brasil/mcp-server"
]
}
}
} {
"servers": {
"br-com-signdocs-mcp-server": {
"command": "npx",
"args": [
"-y",
"@signdocs-brasil/mcp-server"
]
}
}
} codex mcp add br-com-signdocs-mcp-server -- npx -y @signdocs-brasil/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"br-com-signdocs-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@signdocs-brasil/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add br-com-signdocs-mcp-server --command npx --arg -y --arg @signdocs-brasil/mcp-server
mcp_servers:
br-com-signdocs-mcp-server:
command: "npx"
args: ["-y", "@signdocs-brasil/mcp-server"] {
"McpServers": {
"br-com-signdocs-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@signdocs-brasil/mcp-server"
]
}
}
} assistant mcp add br-com-signdocs-mcp-server -t stdio -c npx -a -y @signdocs-brasil/mcp-server
{
"mcpServers": {
"br-com-signdocs-mcp-server": {
"command": "npx",
"args": [
"-y",
"@signdocs-brasil/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −2
- Stability: pass → 0.83 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −2
- Stability: pass → 0.80 functional
- 8 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@signdocs-brasil/mcp-server@0.11.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 97 packages
| Packages resolved | 97 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_session_to_envelope Add signer to envelope ~233
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Add a signing session for one signer to an envelope. Returns IDs plus a ready-to-share `signingUrl`.
| Name | Type | Req | Description |
|---|---|---|---|
| cancelUrl | string | – | – |
| envelopeId | string | yes | The envelope to add a signer to. |
| metadata | object | – | Free-form key/value tags (keys ≤256, values ≤1024 chars). |
| policyProfile | string | yes | Identity-assurance profile: CLICK_ONLY, CLICK_PLUS_OTP, BIOMETRIC, BIOMETRIC_PLUS_OTP, or CUSTOM. Read the signdocs://policy-profiles resource for the authoritative list — an invalid value returns 40… |
| purpose | string | – | DOCUMENT_SIGNATURE to sign a PDF; ACTION_AUTHENTICATION to authenticate an action with no document. |
| returnUrl | string | – | – |
| signer | object | yes | The person who will sign / authenticate. |
| signerIndex | integer | yes | Position of this signer, 1-based (1..totalSigners). |
No output schema declared.
No examples provided.
cancel_signing_session Cancel signing session ~67
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Cancel an active signing session. This cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | The signing session ID (sigex_…). |
No output schema declared.
No examples provided.
cancel_transaction Cancel transaction ~63
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Cancel a low-level transaction. This cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| transactionId | string | yes | The transaction ID (txn_…). |
No output schema declared.
No examples provided.
create_envelope Create envelope ~341
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Create a multi-signer envelope around one PDF. After creating, add each signer with add_session_to_envelope. Consumes quota.
| Name | Type | Req | Description |
|---|---|---|---|
| cancelUrl | string | – | – |
| documentBase64 | string | – | Base64-encoded PDF (≤10MB) shared by all signers. |
| documentFilename | string | – | – |
| documentUrl | string | – | Direct, public HTTPS link to the shared PDF (≤10MB) — server fetches it (not a Google Drive /view or private link). |
| expiresInMinutes | integer | – | – |
| idempotencyKey | string | – | Idempotency key for safe retries; a UUID is generated if omitted. |
| locale | string | – | UI/email language. Default pt-BR. |
| metadata | object | – | Free-form key/value tags (keys ≤256, values ≤1024 chars). |
| owner | object | – | The requester (distinct from the signer). When set and signer.email differs, SignDocs auto-emails the signer an invite and notifies the owner on completion. Omit to deliver links yourself via webhook… |
| returnUrl | string | – | – |
| signingMode | string | yes | PARALLEL: anyone signs in any order. SEQUENTIAL: ordered. |
| totalSigners | integer | yes | How many signers will be added to this envelope. |
| uploadToken | string | – | Token from request_document_upload after the user uploaded the PDF. Provide one of documentBase64 / documentUrl / uploadToken. |
No output schema declared.
No examples provided.
create_signing_session Create signing session ~551
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Create a single-signer "express" signing (or action-authentication) session and return its IDs plus a ready-to-share `signingUrl` (url + embed token). Consumes signature quota.
| Name | Type | Req | Description |
|---|---|---|---|
| action | object | – | What is being authenticated — used when purpose=ACTION_AUTHENTICATION. |
| cancelUrl | string | – | Redirect URL if the signer cancels. |
| customSteps | array | – | Ordered step types — REQUIRED only when policyProfile=CUSTOM (e.g. ["CLICKWRAP","OTP"]). |
| documentBase64 | string | – | Base64-encoded PDF (≤10MB). Provide this OR documentUrl when purpose=DOCUMENT_SIGNATURE. |
| documentFilename | string | – | Original filename, e.g. contrato.pdf. |
| documentUrl | string | – | Direct, public HTTPS link to the PDF (≤10MB) — the server fetches it. Must return raw PDF bytes (S3/Dropbox ?dl=1/public .pdf). NOTE: a Google Drive "/view" link or a private file will NOT work. |
| expiresInMinutes | integer | – | Session lifetime, 5–1440 min (default 60). |
| idempotencyKey | string | – | Idempotency key for safe retries; a UUID is generated if omitted. |
| locale | string | – | UI/email language. Default pt-BR. |
| metadata | object | – | Free-form key/value tags (keys ≤256, values ≤1024 chars). |
| owner | object | – | The requester (distinct from the signer). When set and signer.email differs, SignDocs auto-emails the signer an invite and notifies the owner on completion. Omit to deliver links yourself via webhook… |
| policyProfile | string | yes | Identity-assurance profile: CLICK_ONLY, CLICK_PLUS_OTP, BIOMETRIC, BIOMETRIC_PLUS_OTP, or CUSTOM. Read the signdocs://policy-profiles resource for the authoritative list — an invalid value returns 40… |
| purpose | string | yes | DOCUMENT_SIGNATURE to sign a PDF; ACTION_AUTHENTICATION to authenticate an action with no document. |
| returnUrl | string | – | Redirect URL after completion (sessionId appended as query param). |
| signer | object | yes | The person who will sign / authenticate. |
| uploadToken | string | – | Token from request_document_upload, after the user uploaded the PDF on the drag-and-drop page. Best for local files or private Google Drive files (download then drag in). Provide one of documentBase6… |
No output schema declared.
No examples provided.
delete_webhook Delete webhook ~64
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Delete a registered webhook. Event delivery to it stops immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookId | string | yes | The webhook ID to act on. |
No output schema declared.
No examples provided.
download_document Download document ~37
Get presigned download URLs for a transaction’s document and signed artifacts.
| Name | Type | Req | Description |
|---|---|---|---|
| transactionId | string | yes | The transaction ID (txn_…). |
No output schema declared.
No examples provided.
get_envelope Get envelope ~37
Get envelope details including per-signer session summaries and completion counts.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | The envelope ID (env_…). |
No output schema declared.
No examples provided.
get_envelope_combined_stamp Get envelope combined stamp ~48
Generate the combined stamped PDF (all signers) for a COMPLETED envelope and return a download URL.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | The envelope ID (env_…). |
No output schema declared.
No examples provided.
get_evidence Get evidence ~44
Retrieve the cryptographic evidence (hashes, step proofs, evidenceId) for a completed transaction.
| Name | Type | Req | Description |
|---|---|---|---|
| transactionId | string | yes | The transaction ID (txn_…). |
No output schema declared.
No examples provided.
get_signing_session Get signing session details ~45
Get full bootstrap data for a signing session (signer, steps, document, appearance).
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | The signing session ID (sigex_…). |
No output schema declared.
No examples provided.
get_signing_session_status Get signing session status ~51
Poll the current status of a signing session (ACTIVE/COMPLETED/CANCELLED/EXPIRED/FAILED).
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | The signing session ID (sigex_…). |
No output schema declared.
No examples provided.
get_transaction Get transaction ~37
Get full details of a single transaction, including its steps and results.
| Name | Type | Req | Description |
|---|---|---|---|
| transactionId | string | yes | The transaction ID (txn_…). |
No output schema declared.
No examples provided.
list_signing_sessions List signing sessions ~74
List signing sessions filtered by status, with cursor pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Pagination cursor from a previous response (nextCursor). |
| limit | integer | – | Page size (default server value). |
| status | string | yes | Filter by status: ACTIVE, COMPLETED, CANCELLED, EXPIRED, or FAILED. |
No output schema declared.
No examples provided.
list_transactions List / find transactions ~129
Search transactions by status, signer external ID, document group, or date range (cursor pagination). Use this to find a transaction or check signing history.
| Name | Type | Req | Description |
|---|---|---|---|
| documentGroupId | string | – | – |
| endDate | string | – | ISO date upper bound. |
| limit | integer | – | – |
| nextToken | string | – | Pagination token from a previous response. |
| startDate | string | – | ISO date lower bound. |
| status | string | – | Filter by transaction status (e.g. PENDING, COMPLETED, CANCELLED). |
| userExternalId | string | – | Filter by signer external ID. |
No output schema declared.
No examples provided.
list_webhooks List webhooks ~18
List all registered webhooks for the tenant.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
register_webhook Register webhook ~79
Register an HTTPS endpoint to receive event notifications. The response returns a signing secret — store it to verify the HMAC-SHA256 signature on incoming payloads.
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | yes | Event types to subscribe to. The response returns a signing secret for HMAC verification. |
| url | string | yes | HTTPS endpoint that will receive event POSTs. |
No output schema declared.
No examples provided.
request_document_upload Request a document upload link ~112
Get a one-time drag-and-drop upload page URL to give the user so they can upload a PDF directly to SignDocs (file bytes never pass through the chat). Use this when the document is a local file or a private Google Drive file — the user downloads it and drops it on the page. After they confirm the upload, pass the returned uploadToken to create_signing_session, create_envelope, or upload_document.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | Suggested filename for the upload, e.g. contrato.pdf. |
No output schema declared.
No examples provided.
resend_signing_session_otp Resend signing session OTP ~55
Resend the OTP challenge for a signing session, optionally over a specific channel (email/sms).
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Override OTP delivery channel. |
| sessionId | string | yes | The signing session ID. |
No output schema declared.
No examples provided.
test_webhook Test webhook ~37
Send a sample payload to a registered webhook and return the delivery result.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookId | string | yes | The webhook ID to act on. |
No output schema declared.
No examples provided.
upload_document Upload document ~142
Upload a base64-encoded PDF to an existing transaction (≤10MB inline; use presign for larger).
| Name | Type | Req | Description |
|---|---|---|---|
| documentBase64 | string | – | Base64-encoded PDF (≤10MB). |
| documentUrl | string | – | Direct, public HTTPS link to the PDF (≤10MB) — server fetches it (not a Google Drive /view or private link). |
| filename | string | – | – |
| transactionId | string | yes | Transaction to attach the document to (txn_…). |
| uploadToken | string | – | Token from request_document_upload after the user uploaded the PDF. Provide one of documentBase64 / documentUrl / uploadToken. |
No output schema declared.
No examples provided.
verify_document Verify document signatures ~97
⚠️ This performs a consequential, possibly irreversible action (legally-binding signature request and/or quota consumption). Confirm with the human before calling. Inspect an uploaded PDF for embedded electronic/digital signatures. Requires PRODUCTION credentials + the verification:write scope and CONSUMES verification quota. Not available in HML.
| Name | Type | Req | Description |
|---|---|---|---|
| documentBase64 | string | yes | Base64-encoded PDF to inspect for embedded signatures. |
| filename | string | – | – |
No output schema declared.
No examples provided.
verify_envelope Verify envelope (public) ~43
Publicly verify all signers of an envelope and get consolidated download URLs.
| Name | Type | Req | Description |
|---|---|---|---|
| envelopeId | string | yes | Envelope ID to verify all signers for. Public endpoint. |
No output schema declared.
No examples provided.
verify_evidence Verify evidence (public) ~64
Publicly verify a completed signature by its evidenceId. Returns status, document/evidence hashes, steps and signer display info. No authentication needed.
| Name | Type | Req | Description |
|---|---|---|---|
| evidenceId | string | yes | Evidence ID (evd_…) to verify. Public — no signer PII is revealed. |
No output schema declared.
No examples provided.
What is the br.com.signdocs/mcp-server server?
br.com.signdocs/mcp-server is listed in the public MCP registry as br.com.signdocs/mcp-server. Assinatura eletrônica no Brasil (ICP-Brasil): envie, assine e verifique com sua conta SignDocs. This page covers its npm package (@signdocs-brasil/mcp-server).
Is the br.com.signdocs/mcp-server server safe to use?
br.com.signdocs/mcp-server scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the br.com.signdocs/mcp-server server expose?
br.com.signdocs/mcp-server exposes 24 tools: create_signing_session, get_signing_session_status, get_signing_session, list_signing_sessions, cancel_signing_session, and 19 more. Their descriptions and schemas cost roughly 2,468 tokens of context every time the server is loaded.
Is the br.com.signdocs/mcp-server server still maintained?
br.com.signdocs/mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the br.com.signdocs/mcp-server server under?
br.com.signdocs/mcp-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.