29
/ 100
1 month ago
glama

swiftsign-mcp

E-signature for AI agents. One unauthenticated call returns a sandbox API key (no account, no browser), then the agent can send documents for signature, check status, and download the sealed PDF plus Certificate of Completion.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
12 flows detected: SWIFTSIGN_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Tool annotations don’t match behaviour
1 read-only tool performs write/delete/exec — swiftsign_download_signed_pdf (line 441: writeFile(target, buffer))
⚠️
Known vulnerabilities in dependencies: 8 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: DOCUSIGN_INTEGRATION_KEY, SWIFTSIGN_API_KEY, SWIFTSIGN_SEED_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies8 high7 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highnext@16.2.1GHSA-267c-6grr-h53f

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

highnext@16.2.1GHSA-26hh-7cqf-hhc6

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

highnext@16.2.1GHSA-36qx-fr4f-26g5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

highnext@16.2.1GHSA-492v-c6pp-mqqv

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

highnext@16.2.1GHSA-8h8q-6873-q5fj

Next.js Vulnerable to Denial of Service with Server Components

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configDATABASE_URLNeon PostgreSQL database; copy the pooled connection string to .
🔐 secretDOCUSIGN_INTEGRATION_KEY
configDOCUSIGN_REDIRECT_PORT
configNEXT_PUBLIC_SENTRY_DSN
configSENTRY_DSN
configSKIP_ENV_VALIDATION
🔐 secretSWIFTSIGN_API_KEYConfigure with (and optionally SWIFTSIGN_API_URL for self-hosted instances).
configSWIFTSIGN_API_URLConfigure with SWIFTSIGN_API_KEY (and optionally for self-hosted instances).
🔐 secretSWIFTSIGN_SEED_API_KEY
configSWIFTSIGN_URL
configUX_TEST_API_URL
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/shahdadk-swiftsign-w57jq6)](https://m8ven.ai/mcp/shahdadk-swiftsign-w57jq6)
commit: 766f73e3a0e8705f8ca0816eb07aad22c004be17
code hash: c42c46625c64b38c07f80aa0cc4b99241e798329c2ed6e169886455c3f65a910
verified: 6/15/2026, 12:44:37 PM
view raw JSON →