Mx Seal Cfdi
mx__seal_cfdiSeal CFDI 4.0 invoices locally with CSD key/certificate, or choose PAC mode to return XML unsealed for your PAC to sign.
Instructions
Seal (or deliberately not seal) a CFDI 4.0 Comprobante, PAC-agnostic.
sealing_mode="local" computes the cadena original via the actual SAT
XSLT transform (specs/cadenaoriginal_4_0.xslt, with its utilerias.xslt
and Pagos20.xslt includes resolved from specs/; any other complemento
include a document might reference is not in Phase-1 scope and stubs to
a no-op template — see SelloDigitalSigner's docstring), then computes
Sello/NoCertificado/Certificado via
mcp_einvoicing_core.digital_signature.SelloDigitalSigner — no local
reimplementation of the signing algorithm.
sealing_mode="pac" returns xml unchanged: some PACs accept an
unsealed, schema-valid CFDI and seal it on the emisor's behalf. This
tool does not submit to any PAC — see the package README for the
PAC-agnostic design.
CSD key material is always a file path, never accepted as plaintext key content in a tool argument.
Returns a dict with:
xml: the sealed (or, for"pac", unchanged) XML stringsealing_mode: echoes the mode used
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| xml | Yes | The unsealed CFDI 4.0 Comprobante XML, as returned by mx__build_cfdi/mx__build_pago | |
| key_path | No | Path to the CSD's encrypted PKCS#8 DER private key (.key). Required when sealing_mode='local'. | |
| cert_path | No | Path to the CSD's DER-encoded certificate (.cer). Required when sealing_mode='local'. | |
| key_password | No | Passphrase for the private key. Required when sealing_mode='local'. This is a secret that transits the tool call as plain text — callers should source it from an environment variable or secrets manager reference on their side rather than hardcoding it, the same as cert_path/key_path are file references rather than inline key material. | |
| sealing_mode | Yes | 'local': compute Sello/NoCertificado/Certificado from the supplied CSD. 'pac': return the XML unchanged, for a PAC that seals on the emisor's behalf. | |
| no_certificado | No | The CSD's 20-digit serial number from the SAT enrollment acknowledgment (acuse). Not derived from the certificate bytes — no confirmed algorithm exists for that derivation, see SelloDigitalSigner's docstring. Required when sealing_mode='local'. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||