PandaDoc
NPM · @MINDSTONE/MCP-SERVER-PANDADOC · SCANNED SEP 21
PandaDoc document automation MCP server for Model Context Protocol hosts
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency87
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to mindstone/mcp-servers). View diagnostics → Pass
- License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 44 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3132 tokens (~208/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the PandaDoc MCP server?
PandaDoc runs locally as an npm package, launched with npx -y @mindstone/mcp-server-pandadoc. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mindstone/mcp-server-pandadoc
claude mcp add mindstone-mcp-server-pandadoc -- npx -y @mindstone/mcp-server-pandadoc
{
"mcpServers": {
"mindstone-mcp-server-pandadoc": {
"command": "npx",
"args": [
"-y",
"@mindstone/mcp-server-pandadoc"
]
}
}
} {
"servers": {
"mindstone-mcp-server-pandadoc": {
"command": "npx",
"args": [
"-y",
"@mindstone/mcp-server-pandadoc"
]
}
}
} codex mcp add mindstone-mcp-server-pandadoc -- npx -y @mindstone/mcp-server-pandadoc
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mindstone-mcp-server-pandadoc": {
"type": "local",
"command": [
"npx",
"-y",
"@mindstone/mcp-server-pandadoc"
],
"enabled": true
}
}
} openclaw mcp add mindstone-mcp-server-pandadoc --command npx --arg -y --arg @mindstone/mcp-server-pandadoc
mcp_servers:
mindstone-mcp-server-pandadoc:
command: "npx"
args: ["-y", "@mindstone/mcp-server-pandadoc"] {
"McpServers": {
"mindstone-mcp-server-pandadoc": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@mindstone/mcp-server-pandadoc"
]
}
}
} assistant mcp add mindstone-mcp-server-pandadoc -t stdio -c npx -a -y @mindstone/mcp-server-pandadoc
{
"mcpServers": {
"mindstone-mcp-server-pandadoc": {
"command": "npx",
"args": [
"-y",
"@mindstone/mcp-server-pandadoc"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
- Stability: 0.97 → pass security
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 −3
- Stability: pass → 0.80 functional
- 14 Sept 26 +1
- Stability: 0.97 → pass security
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/@mindstone/mcp-server-pandadoc@0.3.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | mindstone/mcp-servers |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/mindstone/mcp-servers/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2371671104 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:cc9fc823b53122d365c4d0186cb7de9549744e8fcb2f6b8528f9e47d32d0a442fffe255866fd8012b651295b868bed80d13d1a6f31dab3f448d0b0fad |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
configure_pandadoc_api_key ~113
Host-managed setup only. The user adds the PandaDoc API key in Settings → Connectors in the app. Do not ask for or accept the key in chat. Get an API key from the PandaDoc Developer Dashboard: Settings → API → Developer Dashboard → Generate a Sandbox key (for testing) or Production key (for live use). Note: API access requires a PandaDoc Business or Enterprise plan.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | yes | The PandaDoc API key from Settings > API > Developer Dashboard |
No output schema declared.
No examples provided.
create_document_from_template ~318
Create a new PandaDoc document from an existing template. Templates can contain fields, tokens (variables), pricing tables, images, and content placeholders. Pre-fill field values, set recipients, and customize content when creating. WORKFLOW: 1. Call list_templates to find the template ID 2. Create the document with this tool (pre-fill fields/tokens as needed) 3. Poll get_document_status until status is 'document.draft' 4. Use send_document to send for signing RELATED TOOLS: - list_templates: Find available templates and their IDs - get_document_details: See all fields/tokens after creation - send_document: Send the created document
| Name | Type | Req | Description |
|---|---|---|---|
| fields | object | – | Map of field names to values: { "FieldName": { "value": "text" } } |
| folder_uuid | string | – | Folder ID to store the document in (see list_document_folders) |
| metadata | object | – | Custom key-value metadata to associate with the document |
| name | string | – | Document name |
| pricing_tables | array | – | Pricing tables to populate. Requires "Automatically add products to this table" enabled on the template pricing table. All product info must be passed here — products stored in PandaDoc cannot be use… |
| recipients | array | yes | Document recipients (at least one required) |
| tags | array | – | Tags to apply |
| template_uuid | string | yes | Template ID (from list_templates or PandaDoc app URL) |
| tokens | array | – | Template variables to pre-fill |
No output schema declared.
No examples provided.
create_document_from_url ~367
Create a PandaDoc document from a publicly accessible PDF URL. PandaDoc fetches the PDF server-side, so no local file is needed — use this instead of upload_document when the source file is already hosted online. WORKFLOW: 1. Create the document with this tool 2. Poll get_document_status until status is 'document.draft' 3. Then use send_document to send it for signing COMMON MISTAKES: - The URL must be HTTPS and publicly accessible (no auth headers, no expiring signed URLs that PandaDoc cannot reach) - Don't try to send while status is 'document.uploaded' — wait for 'document.draft' RELATED TOOLS: - upload_document: Upload a local file instead (must live under MCP_WORKSPACE_PATH) - get_document_status: Check when the document is ready (status = 'document.draft') - send_document: Send the processed document for e-signature
| Name | Type | Req | Description |
|---|---|---|---|
| fields | object | – | Map of field names to values: { "FieldName": { "value": "text" } } |
| folder_uuid | string | – | ID of the PandaDoc folder to store the document in (see list_document_folders) |
| metadata | object | – | Custom key-value metadata to associate with the document |
| name | string | yes | Document name in PandaDoc |
| parse_form_fields | boolean | – | If true, recognizes PDF form fields as PandaDoc fields. Default: false |
| recipients | array | – | List of document recipients (at least one required for sending) |
| tags | array | – | Tags to apply to the document |
| tokens | array | – | Tokens (variables) to pre-fill |
| url | string | yes | Secure (HTTPS) and publicly accessible URL to the PDF document |
No output schema declared.
No examples provided.
create_document_session ~233
Create a view/sign session link for a PandaDoc document recipient. Returns a shareable URL (https://app.pandadoc.com/s/{session_id}) the named recipient can open to view and sign the document — the standard way to hand a client a signing link directly instead of relying on PandaDoc's email. ⚠️ WARNING — anyone with the link can view and sign as that recipient until the session expires. Only create a session when the user has explicitly asked for a signing/view link, and share the URL only through a channel the user chose. The document must already be in 'document.sent' status. RELATED TOOLS: - send_document: Send the document first (session creation requires 'document.sent') - get_document_status: Check the document's current status
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document ID |
| lifetime | integer | – | Link lifetime in seconds (60 to 31535999 ≈ 1 year). Default: 3600 (1 hour) |
| recipient | string | yes | Email address of the document recipient the session is created for |
No output schema declared.
No examples provided.
download_document ~177
Download a PandaDoc document as a PDF file. Returns the file path where the PDF has been saved. The document must be in a completed or sent status to download. RELATED TOOLS: - get_document_status: Check document status before downloading - list_documents: Find document IDs
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document ID |
| separate_files | boolean | – | If true, downloads as a zip archive with separate PDFs per section |
| watermark_color | string | – | Watermark color as HEX code (e.g., "#FF5733") |
| watermark_font_size | integer | – | Watermark font size (integer, 1-500) |
| watermark_opacity | number | – | Watermark opacity (0.0 to 1.0) |
| watermark_text | string | – | Optional watermark text to overlay on the PDF |
No output schema declared.
No examples provided.
get_content_library_item_details ~94
Get full details for a PandaDoc content library item. Returns roles, fields with values, tokens, pricing tables, metadata, and tags — everything needed to understand what a reusable block contributes when assembled into a template or document. RELATED TOOLS: - list_content_library_items: Find content library item IDs
| Name | Type | Req | Description |
|---|---|---|---|
| content_library_item_id | string | yes | The content library item ID (from list_content_library_items) |
No output schema declared.
No examples provided.
get_document_details ~104
Get full details for a PandaDoc document. Returns comprehensive data: recipients, fields, tokens, pricing, metadata, tags, linked objects, and more. Use this to inspect a document's content and state before sending or after completion. RELATED TOOLS: - list_documents: Find document IDs - get_document_status: Quick status check (lighter weight than full details) - send_document: Send the document for signing
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document ID |
No output schema declared.
No examples provided.
get_document_status ~166
Check the current status of a PandaDoc document. Returns: id, name, status, dates. Lightweight alternative to get_document_details. Use this to poll after upload/creation until status changes to 'document.draft'. Status values: document.uploaded, document.draft, document.sent, document.completed, document.viewed, document.waiting_approval, document.approved, document.rejected, document.waiting_pay, document.paid, document.voided, document.declined, document.error WORKFLOW — After upload: 1. Upload returns status 'document.uploaded' 2. Poll this tool every 2-3 seconds 3. When status is 'document.draft', the document is ready to send
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document ID |
No output schema declared.
No examples provided.
list_contacts ~134
List contacts in the PandaDoc workspace. Returns contact ids, names, emails, companies, and other stored details. Use this to discover existing recipients before creating or sending documents. Supports count/page paging; use the pagination hint in the response to page through large workspaces. RELATED TOOLS: - create_document_from_template: Reference discovered contacts as recipients - send_document: Send a document to discovered recipients
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Results per page (default 50, max 100) |
| string | – | Filter by exact email match | |
| page | number | – | Page number (starts at 1) |
No output schema declared.
No examples provided.
list_content_library_items ~208
List PandaDoc content library items (reusable content blocks). Content library items are pre-approved blocks (pricing sections, legal clauses, product descriptions) that teams assemble into templates and documents. Returns item IDs, names, and dates. NOTE: the API rejects empty filter values — omit filters you don't need rather than passing empty strings. RELATED TOOLS: - get_content_library_item_details: Inspect an item's fields, tokens, and pricing - list_templates: List full templates
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Results per page (default 50, max 100) |
| deleted | boolean | – | If true, return only deleted items. Default: false |
| folder_uuid | string | – | Filter by content library folder UUID |
| id | string | – | Fetch a specific content library item by ID |
| page | number | – | Page number (starts at 1) |
| q | string | – | Search by content library item name |
| tag | string | – | Filter by tag |
No output schema declared.
No examples provided.
list_document_folders ~170
List PandaDoc document folders. Returns folder UUIDs and names. Use a folder's uuid as the folder_uuid input of create_document_from_template, upload_document, create_document_from_url, or the list_documents/list_templates filters. NOTE: the root folder is not listed by the API. Pass a folder's uuid as parent_uuid to list its subfolders; omit parent_uuid to list top-level folders. RELATED TOOLS: - list_documents: Filter documents by folder_uuid - list_templates: Filter templates by folder_uuid
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Results per page (default 50, max 100) |
| page | number | – | Page number (starts at 1) |
| parent_uuid | string | – | UUID of the parent folder. Omit to list top-level folders. |
No output schema declared.
No examples provided.
list_documents ~325
List and search PandaDoc documents with filtering. Supports filtering by status, template, name/reference, tags, metadata, date ranges, and more. Returns compact summaries: id, name, status, dates. Status codes: 0=draft, 1=sent, 2=completed, 3=uploaded, 4=error, 5=viewed, 6=waiting_approval, 7=approved, 8=rejected, 9=waiting_pay, 10=paid, 11=voided, 12=declined RELATED TOOLS: - get_document_details: Get full details for a specific document - get_document_status: Quick status check by document ID
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Results per page (default 50, max 100) |
| created_from | string | – | Documents created on or after this date (ISO 8601) |
| created_to | string | – | Documents created before this date (ISO 8601) |
| folder_uuid | string | – | Filter by folder ID |
| order_by | string | – | Sort field. Prefix with - for DESC (e.g., "-date_created"). Default: date_status_changed |
| page | number | – | Page number (starts at 1) |
| q | string | – | Search by document name or reference number |
| status | number | – | Filter by status code (0=draft, 1=sent, 2=completed, etc.) |
| tag | string | – | Filter by tag |
| template_id | string | – | Filter by parent template ID |
No output schema declared.
No examples provided.
list_templates ~117
List available PandaDoc templates. Returns template IDs, names, and dates. Use template IDs with create_document_from_template. RELATED TOOLS: - create_document_from_template: Use a template ID to create a new document
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Results per page (default 50, max 100) |
| folder_uuid | string | – | Filter by folder ID |
| page | number | – | Page number (starts at 1) |
| q | string | – | Search by template name |
| tag | array | – | Filter by tags |
No output schema declared.
No examples provided.
send_document ~301
Send a PandaDoc document to recipients for viewing/signing. The document must be in 'document.draft' status before sending. Optionally include a custom email message and subject line. ⚠️ WARNING — silent: true SUPPRESSES SIGNER NOTIFICATIONS. Setting silent: true tells PandaDoc to skip / suppress the email notifications that would normally be sent to every recipient. The document is still marked as sent on the PandaDoc side, but no signer notification email is delivered, which means recipients have no way of knowing the document is waiting for them unless they are notified through some other channel. Default is false (notifications are sent). Only pass silent: true when the user has explicitly asked you to skip / suppress the email notifications for this send. COMMON MISTAKES: - Cannot send a document in 'document.uploaded' status — wait for 'document.draft' - Cannot re-send a document that is already 'document.completed' or 'document.voided' RELATED TOOLS: - get_document_status: Verify document is in 'document.draft' before sending - get_document_details: Review document content before sending
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document ID |
| message | string | – | Email body message sent to recipients with the document link |
| silent | boolean | – | If true, suppresses email notifications to recipients. Default: false |
| subject | string | – | Email subject line |
No output schema declared.
No examples provided.
upload_document ~305
Upload a PDF, DOCX, or RTF file to PandaDoc to create a new document. The file is uploaded and converted into an interactive PandaDoc document. After upload, the document status is 'document.uploaded' and transitions to 'document.draft' after processing (typically 1-5 seconds). WORKFLOW: 1. Upload the file with this tool 2. Poll get_document_status until status is 'document.draft' 3. Then use send_document to send it for signing COMMON MISTAKES: - Don't try to send a document while it's still in 'document.uploaded' status — wait for 'document.draft' - File must be under 50 MB - Encrypted PDFs are not supported RELATED TOOLS: - get_document_status: Check when document is ready (status = 'document.draft') - send_document: Send the processed document for e-signature
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the PDF, DOCX, or RTF file to upload |
| folder_uuid | string | – | ID of the PandaDoc folder to store the document in |
| name | string | – | Document name in PandaDoc (defaults to filename) |
| parse_form_fields | boolean | – | If true, recognizes PDF form fields as PandaDoc fields. Default: false |
| recipients | array | – | List of document recipients (at least one required for sending) |
| tags | array | – | Tags to apply to the document |
No output schema declared.
No examples provided.
What is the PandaDoc MCP server?
PandaDoc is an MCP server listed in the public MCP registry as io.github.mindstone/mcp-server-pandadoc. PandaDoc document automation MCP server for Model Context Protocol hosts. This page covers its npm package (@mindstone/mcp-server-pandadoc).
Is the PandaDoc MCP server safe to use?
PandaDoc scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PandaDoc MCP server expose?
PandaDoc exposes 15 tools: configure_pandadoc_api_key, list_documents, get_document_status, get_document_details, create_document_from_template, and 10 more. Their descriptions and schemas cost roughly 3,132 tokens of context every time the server is loaded.
Is the PandaDoc MCP server still maintained?
PandaDoc is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the PandaDoc MCP server under?
PandaDoc declares the FSL-1.1-MIT licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.