Swiftsign Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Swiftsign Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="./assets/banner.svg" alt="SwiftSign: AI-native e-signatures" width="100%"> </p>
<p align="center"> <a href="https://www.npmjs.com/package/swiftsign-mcp"><img src="https://img.shields.io/npm/v/swiftsign-mcp?style=flat-square&color=0D1117&label=npm" alt="npm"></a> <a href="https://github.com/shahdadk/swiftsign-mcp/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-0D1117?style=flat-square" alt="MIT"></a> <img src="https://img.shields.io/badge/MCP-stdio-0D1117?style=flat-square" alt="MCP stdio"> <img src="https://img.shields.io/badge/Claude_Code_·_Cursor_·_Zed-0D1117?style=flat-square" alt="Compatible clients"> <a href="https://swiftsign.ca"><img src="https://img.shields.io/badge/swiftsign.ca-live-0D1117?style=flat-square" alt="Live"></a> </p>
E-signature for AI agents. An MCP server that lets Claude Code, Cursor, Zed, or any MCP-aware agent prepare, send, track, and seal legally binding documents without a human ever touching a mouse.
DocuSign assumes a person with a cursor dragging signature boxes onto a PDF. SwiftSign assumes code. An agent mints its own sandbox key, sends a contract, watches it get signed, and pulls back the sealed PDF and Certificate of Completion. No drag handles. No per-seat fees.
claude mcp add swiftsign -- npx -y swiftsign-mcpOr add it to your .mcp.json directly:
{
"mcpServers": {
"swiftsign": {
"command": "npx",
"args": ["-y", "swiftsign-mcp"],
"env": { "SWIFTSIGN_API_KEY": "sk_test_..." }
}
}
}No key yet? You do not need the dashboard. Start the server with no key and call `swiftsign_signup` to mint a sandbox key in one tool call.
An agent can go from nothing to a sealed document without ever opening a web page:
1. swiftsign_signup → mint a sandbox key (sk_test_...), no account, no card
2. swiftsign_send_envelope → send a PDF, place fields by anchor text or coordinates
3. swiftsign_check_status → poll until signed
4. swiftsign_download_signed_pdf → pull back the sealed PDF + Certificate of CompletionLive sends are confirm-gated: a real, legally binding send requires an explicit swiftsign_confirm_send so an agent cannot fire a contract by accident.
| Tool | What it does |
|---|---|
swiftsign_signup | Mint a sandbox account + sk_test_ key. The only tool that runs with no key set. |
swiftsign_send_envelope | Send one or more PDFs for signature; anchor-text or coordinate field placement. |
swiftsign_confirm_send | Confirm a live (legally binding) send. Safety gate against accidental sends. |
swiftsign_send_from_template | Send from a saved template by recipient role. |
swiftsign_check_status | Check signing status of an envelope. |
swiftsign_list_envelopes | List sent envelopes. |
swiftsign_list_templates | List saved templates. |
swiftsign_create_embedded_url | Mint a short-lived embedded signing URL. |
swiftsign_download_signed_pdf | Download the sealed PDF + Certificate of Completion. |
swiftsign_void_envelope | Cancel an in-flight envelope. |
swiftsign_upgrade | Get a Stripe link to enable live sends. |
Bring your existing templates with you. The bundled importer (src/docusign/) authenticates against the DocuSign API and maps your templates and fields into SwiftSign, so an agent can migrate a signing workflow instead of rebuilding it.
swiftsign_upgrade (a Stripe link you open to add a card). The same tools work in both modes; the key decides.SwiftSign signatures carry a tamper-evident SHA-256 seal, a full audit trail, and a Certificate of Completion. Enforceable under:
| Env var | Required | Description |
|---|---|---|
SWIFTSIGN_API_KEY | no | sk_test_ or sk_live_ key. Optional at startup; mint one with swiftsign_signup. |
SWIFTSIGN_API_URL | no | Override the API base for self-hosted SwiftSign instances. |
npm install
npm run build # compiles src/ → dist/
npm test # node --testMIT © Shahdad Kompani
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.