37
/ 100
1 month ago
glama

sign-cli

Agent-first e-signature CLI: a 19-tool MCP server with offline PAdES signing (real PKCS#7) and a hash-chained audit log with RFC 3161 timestamping. Per-signer approval tokens keep humans in the loop while agents drive every other step. Stdio + HTTP transports.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 7 credentials: DOCUSIGN_INTEGRATION_KEY, DOCUSIGN_WEBHOOK_SECRET, DROPBOX_SIGN_API_KEY, SIGNWELL_API_KEY, SIGNWELL_WEBHOOK_SECRET, SIGN_HTTP_AUTH_TOKEN, SIGN_MCP_HTTP_AUTH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configDOCUSIGN_ACCOUNT_ID
configDOCUSIGN_BASE_PATH
🔐 secretDOCUSIGN_INTEGRATION_KEY
configDOCUSIGN_PRIVATE_KEY_PATH
configDOCUSIGN_USER_ID
🔐 secretDOCUSIGN_WEBHOOK_SECRET
🔐 secretDROPBOX_SIGN_API_KEY
configDROPBOX_SIGN_CLIENT_ID
configDROPBOX_SIGN_TEST_MODE
configPORT
🔐 secretSIGNWELL_API_KEYsign profile set --name prod --key credentials. --value "{{env:SIGNWELL_API_KEY}}"
configSIGNWELL_BASE_URL
configSIGNWELL_SMOKE_SIGNER_EMAIL
configSIGNWELL_TEST_MODE
🔐 secretSIGNWELL_WEBHOOK_SECRET
configSIGN_ALLOW_ABSOLUTE_DOCS
configSIGN_DB_BACKEND
configSIGN_DB_PATH
configSIGN_DEBUG
configSIGN_ERROR_FORMAT
🔐 secretSIGN_HTTP_AUTH_TOKEN
configSIGN_HTTP_BASE_DELAY_MS
configSIGN_HTTP_MAX_RETRIES
configSIGN_LOCAL_AUTOCOMPLETEFor --provider local, an agent can act as a signer end-to-end without an email link. Set =false so the local provider holds at sent until each signer explicitly runs sign sign.
configSIGN_LOCAL_COMPLETE_AFTER
configSIGN_LOCAL_KEY_DIR
configSIGN_LOCAL_MAX_FETCHES_PER_HOUR
configSIGN_LOCAL_NOTIFY_URL
configSIGN_LOCAL_STORE_DIR
configSIGN_LOG_FORMAT
configSIGN_MAX_DOCUMENT_BYTES
🔐 secretSIGN_MCP_HTTP_AUTH_TOKEN
configSIGN_PG_URL
configSIGN_PROFILE
configSIGN_PROFILES_FILE
configSIGN_PROVIDER
configSIGN_STRICT_PROVIDER
configSIGN_TSA_URL
configXDG_CONFIG_HOME
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/drbaher-sign-cli-1lwcx3)](https://m8ven.ai/mcp/drbaher-sign-cli-1lwcx3)
commit: bb67c3f2a892746105f58e65df3a007fe0400c8c
code hash: 27f66194b25ce2c17c85fe29fbaba9d65a98e7472ef69c4326ec9ed101c673eb
verified: 6/10/2026, 11:42:09 AM
view raw JSON →