LayerOne (DocX + Sign)
NPM · LAYERONE-MCP · SCANNED SEP 20
MCP server for LayerOne DocX (documents & Factur-X) and Sign (e-signature) APIs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to GOLayerone/layerone-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 93 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability80
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1530 tokens (~76/item across 20 items; 20 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "docx_delete_template" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the LayerOne (DocX + Sign) MCP server?
LayerOne (DocX + Sign) runs locally as an npm package, launched with npx -y layerone-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · layerone-mcp
claude mcp add golayerone-layerone -- npx -y layerone-mcp
{
"mcpServers": {
"golayerone-layerone": {
"command": "npx",
"args": [
"-y",
"layerone-mcp"
]
}
}
} {
"servers": {
"golayerone-layerone": {
"command": "npx",
"args": [
"-y",
"layerone-mcp"
]
}
}
} codex mcp add golayerone-layerone -- npx -y layerone-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"golayerone-layerone": {
"type": "local",
"command": [
"npx",
"-y",
"layerone-mcp"
],
"enabled": true
}
}
} openclaw mcp add golayerone-layerone --command npx --arg -y --arg layerone-mcp
mcp_servers:
golayerone-layerone:
command: "npx"
args: ["-y", "layerone-mcp"] {
"McpServers": {
"golayerone-layerone": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"layerone-mcp"
]
}
}
} assistant mcp add golayerone-layerone -t stdio -c npx -a -y layerone-mcp
{
"mcpServers": {
"golayerone-layerone": {
"command": "npx",
"args": [
"-y",
"layerone-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.83 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 14 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
- 13 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/layerone-mcp@1.0.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | GOLayerone/layerone-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/GOLayerone/layerone-mcp/.github/workflows/publish.yml@refs/heads/main |
| Rekor log index | 1862722949 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:c6c763699c311b0480555cb02ae1fe2f77c9abc17aa54564352a477bf57c54d93a6ad3166599ed36d1ec390004bdf7db3233af31cc835dcefef1445ba |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
docx_delete_template DocX — Supprimer un modèle ~39
Supprime définitivement un modèle et tout son historique de versions. Action irréversible.
| Name | Type | Req | Description |
|---|---|---|---|
| template_id | string | yes | ID du modèle à supprimer. |
No output schema declared.
No examples provided.
docx_download_template DocX — Télécharger un modèle ~52
Télécharge le fichier .docx d'un modèle déposé. Renvoie un résumé du fichier (taille + aperçu base64 tronqué).
| Name | Type | Req | Description |
|---|---|---|---|
| template_id | string | yes | ID du modèle à télécharger. |
No output schema declared.
No examples provided.
docx_download_template_version DocX — Télécharger une version de modèle ~69
Télécharge le fichier .docx d'une version archivée d'un modèle. Renvoie un résumé du fichier (taille + aperçu base64 tronqué).
| Name | Type | Req | Description |
|---|---|---|---|
| template_id | string | yes | ID du modèle. |
| version_id | integer | yes | ID numérique de la version archivée. |
No output schema declared.
No examples provided.
docx_get_usage_stats DocX — Consulter le quota et l'usage ~39
Retourne le plan, le quota (limite / utilisé / restant) et les statistiques d'usage de la clé API DocX.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
docx_list_template_versions DocX — Lister les versions d'un modèle ~35
Liste l'historique des versions archivées d'un modèle.
| Name | Type | Req | Description |
|---|---|---|---|
| template_id | string | yes | ID du modèle. |
No output schema declared.
No examples provided.
docx_list_templates DocX — Lister les modèles ~69
Liste les modèles Word déposés pour la clé API. Un filtre optionnel par nom (contient le texte) est appliqué côté client à partir de la liste retournée.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filtre optionnel : ne garde que les modèles dont le nom contient ce texte. |
No output schema declared.
No examples provided.
docx_render_document DocX — Générer un document ~142
Génère un document (PDF ou DOCX) — devis, contrat, attestation — à partir d'un modèle déposé et de données JSON. Renvoie un résumé du fichier généré.
| Name | Type | Req | Description |
|---|---|---|---|
| json_data | string | yes | Données du document au format chaîne JSON, ex : {"client":"ACME","date":"2026-01-15","total":1200}. |
| output_filename | string | – | Nom du fichier généré (défaut : document.pdf). |
| output_format | string | – | Format de sortie (défaut : pdf). |
| template_id | string | yes | ID d'un modèle déjà déposé sur DocX. |
No output schema declared.
No examples provided.
docx_render_facturx DocX — Générer une facture Factur-X ~141
Génère une facture électronique conforme à la réforme 2026 (Factur-X / PDF-A3) à partir d'un modèle déposé et de données JSON. Renvoie un résumé du PDF généré (taille + aperçu base64 tronqué).
| Name | Type | Req | Description |
|---|---|---|---|
| json_data | string | yes | Données de la facture au format chaîne JSON, ex : {"Npiece":"F2026-001","client":"ACME","total":1200}. |
| output_filename | string | – | Nom du fichier PDF généré (défaut : facture.pdf). |
| template_id | string | yes | ID d'un modèle déjà déposé sur DocX. |
No output schema declared.
No examples provided.
docx_restore_template_version DocX — Restaurer une version de modèle ~63
Restaure une version archivée comme version active du modèle. La version courante est archivée avant écrasement.
| Name | Type | Req | Description |
|---|---|---|---|
| template_id | string | yes | ID du modèle. |
| version_id | integer | yes | ID numérique de la version à restaurer. |
No output schema declared.
No examples provided.
docx_update_template DocX — Mettre à jour un modèle ~90
Remplace un modèle existant par une nouvelle version (.docx). L'ancienne version est automatiquement archivée (rollback possible).
| Name | Type | Req | Description |
|---|---|---|---|
| template_base64 | string | yes | Nouveau fichier .docx encodé en base64. |
| template_id | string | yes | ID du modèle à mettre à jour. |
| template_name | string | – | Nom du fichier (défaut : template.docx). |
No output schema declared.
No examples provided.
docx_upload_template DocX — Déposer un modèle ~102
Dépose un modèle Word (.docx) sur le compte pour le réutiliser ensuite par son ID. Retourne l'ID du modèle et les balises {{ ... }} détectées. Le fichier est fourni encodé en base64.
| Name | Type | Req | Description |
|---|---|---|---|
| template_base64 | string | yes | Contenu du fichier .docx encodé en base64. |
| template_name | string | – | Nom du fichier modèle (défaut : template.docx). |
No output schema declared.
No examples provided.
sign_cancel_document Sign — Annuler une demande de signature ~43
Annule une demande de signature encore en cours. Impossible si le document est déjà signé.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | ID du document de signature à annuler. |
No output schema declared.
No examples provided.
sign_detect_fields Sign — Détecter les champs de signature ~67
Analyse un PDF et retourne les emplacements de signature balisés ([[...]]) détectés, avant de l'envoyer à la signature. Le PDF est fourni encodé en base64.
| Name | Type | Req | Description |
|---|---|---|---|
| pdf_base64 | string | yes | Contenu du document PDF encodé en base64. |
No output schema declared.
No examples provided.
sign_download_signed_document Sign — Télécharger le document signé ~67
Récupère le PDF final signé (signature PAdES qualifiée + certificat de preuve intégré). Disponible une fois le document complété. Renvoie un résumé (titre, taille, aperçu base64 tronqué).
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | ID du document de signature. |
No output schema declared.
No examples provided.
sign_get_audit_certificate Sign — Récupérer le certificat de preuve ~57
Récupère le certificat de preuve juridique complet : qui a signé, depuis quelle IP, à quelle heure, avec la chaîne de hachage cryptographique.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | ID du document de signature. |
No output schema declared.
No examples provided.
sign_get_document_status Sign — Consulter le statut d'une signature ~44
Consulte l'état d'avancement d'une demande de signature (en attente, signé, refusé…).
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | ID du document de signature. |
No output schema declared.
No examples provided.
sign_send_for_signature Sign — Envoyer un document à signer ~215
Envoie un PDF à signer électroniquement (eIDAS / PAdES). Crée la demande et envoie l'email d'invitation au signataire. Le PDF est fourni encodé en base64.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | – | Nom de la société affichée au signataire. |
| document_name | string | yes | Nom du document. |
| expiry_days | integer | – | Délai d'expiration de la demande en jours (défaut : 30). |
| note | string | – | Message d'accompagnement adressé au signataire. |
| pdf_base64 | string | yes | Contenu du document PDF encodé en base64. |
| signer_email | string | yes | Email du signataire. |
| signer_name | string | yes | Nom du signataire. |
| signer_phone | string | – | Téléphone du signataire au format international (+33…), requis seulement pour l'OTP SMS. |
| signer_role | string | – | Rôle du signataire (défaut : Client). |
No output schema declared.
No examples provided.
sign_send_otp Sign — Envoyer un code de vérification (SMS) ~87
Envoie un code OTP par SMS au signataire pour vérifier son identité avant la signature.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | ID du document. |
| document_name | string | – | Nom du document (affiché dans le SMS). |
| signer_email | string | yes | Email du signataire. |
| signer_phone | string | yes | Téléphone du signataire au format international (+33…). |
No output schema declared.
No examples provided.
sign_validate_signature Sign — Vérifier l'intégrité de la signature ~41
Vérifie cryptographiquement que la signature PAdES du document est intègre et valide.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | ID du document de signature. |
No output schema declared.
No examples provided.
sign_verify_otp Sign — Vérifier un code de vérification (SMS) ~68
Valide le code OTP saisi par le signataire et retourne l'URL de signature si le code est correct.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Code reçu par SMS. |
| document_id | string | yes | ID du document. |
| signer_email | string | yes | Email du signataire. |
No output schema declared.
No examples provided.
What is the LayerOne (DocX + Sign) MCP server?
LayerOne (DocX + Sign) is an MCP server listed in the public MCP registry as io.github.GOLayerone/layerone. MCP server for LayerOne DocX (documents & Factur-X) and Sign (e-signature) APIs. This page covers its npm package (layerone-mcp).
Is the LayerOne (DocX + Sign) MCP server safe to use?
LayerOne (DocX + Sign) scores 93 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the LayerOne (DocX + Sign) MCP server expose?
LayerOne (DocX + Sign) exposes 20 tools: docx_render_facturx, docx_render_document, docx_list_templates, docx_upload_template, docx_update_template, and 15 more. Their descriptions and schemas cost roughly 1,530 tokens of context every time the server is loaded.
Is the LayerOne (DocX + Sign) MCP server still maintained?
LayerOne (DocX + Sign) is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the LayerOne (DocX + Sign) MCP server under?
LayerOne (DocX + Sign) declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.