Swiftsign — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Swiftsign (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="./assets/banner.svg" alt="SwiftSign: AI-native e-signatures" width="100%"> </p>
<p align="center"> <a href="https://swiftsign.ca"><img src="https://img.shields.io/badge/swiftsign.ca-live-0D1117?style=flat-square" alt="Live"></a> <a href="https://github.com/shahdadk/swiftsign-mcp"><img src="https://img.shields.io/badge/MCP-swiftsign--mcp-0D1117?style=flat-square" alt="MCP server"></a> <img src="https://img.shields.io/badge/SDKs-JS_·_Python-0D1117?style=flat-square" alt="SDKs"> <img src="https://img.shields.io/badge/ESIGN_·_UETA_·_PIPEDA-0D1117?style=flat-square" alt="Compliant"> </p>
AI-native e-signatures. Send, track, and seal contracts from your terminal: Claude Code, Cursor, Zed, or any MCP-aware agent. No drag handles. No per-seat fees.
DocuSign assumes a person with a cursor, dragging signature boxes onto a PDF and paying per seat. SwiftSign assumes code. It is API-first and agent-native: a script or an AI agent can mint a key, send a legally binding contract, track it to completion, and pull back the sealed PDF and Certificate of Completion, end to end, without a browser.
/api/v1/envelopes, bearer-token auth, quota-enforced.claude mcp add swiftsign -- npx -y swiftsign-mcp"Send the MSA at ./contracts/Acme_MSA.pdf to [email protected] for signing,
with a signature field at the bottom."The agent mints a sandbox key if it has none, places the fields, emails the signer a link, and reports back when it is sealed. See swiftsign-mcp for the full tool list.
@prisma/adapter-pg/api/v1/envelopes: public REST API; bearer-token auth via Authorization: Bearer <apiKey>. Quota enforced (5/mo on Free, unlimited on Pro/Team)./sign/[token] and /api/sign/[token]: recipient signing flow. No account; the signingToken is the only credential./dashboard/*: sender UI. Cookie session via swiftsign_session. Envelopes, billing, settings (API key, sessions), webhooks./api/stripe/webhook: Stripe to DB sync (subscription and plan)./api/cron/webhook-retry: runs every 5 minutes via vercel.json to retry failed outbound webhook deliveries.git clone https://github.com/shahdadk/swiftsign.git
cd swiftsign
./scripts/bootstrap.shThe bootstrap script installs the Vercel CLI, logs you in, links the checkout to the SwiftSign Vercel project, pulls production env vars into .env.local, and runs npm install. Then npm run dev and you are operational.
Manual setup:
npm install # legacy-peer-deps is pinned in .npmrc (React 19 / Next 16)
npx prisma generate # writes the Prisma client to src/generated/prisma/
npx prisma migrate deploy # apply schema migrations to your dev DB
npm run dev # dev server on port 3000Common commands:
npm run dev: start the dev server on port 3000npm run build: production build (Turbopack)npm run start: run the built servernpm run lint: ESLintnpx prisma migrate dev --name <slug>: create a new migrationnpx tsx prisma/seed.ts: seed a local userProvision Neon (PostgreSQL), Cloudflare R2, Resend, Stripe (Pro and Team products plus a webhook on /api/stripe/webhook), Upstash Redis, and Sentry. Set the env vars from .env.local.example on the Vercel project (Production and Preview), connect the repo, and push to main. Vercel runs npx prisma generate and next build. Apply schema once with npx prisma migrate deploy. Verify at /api/healthcheck.
The MCP server has its own repository at swiftsign-mcp and is published to npm as swiftsign-mcp.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.