Start here on a machine that has never sent a signature request.

Reports which credentials are missing and where the present ones came from, then gives the URLs for creating a TurboDocx account and finding the API key and organization id. Follow the URLs, then call turbosign_configure() with the three values.

Set open_browser=True to also try opening the console locally — it is best-effort and reports whether it worked, since a server without a desktop has no browser to open.

Save this machine's TurboDocx credentials after checking they work.

The credentials are verified against the live API before anything is written, so a mistyped key fails here rather than on your first real send. They are stored owner-only in ~/.turbosign-mcp/credentials.json.

Get the values from turbosign_setup(). sender_email is the reply-to address recipients see. sender_name is optional and defaults to the name on the API key. base_url is only for a non-production endpoint.

The key is never echoed back — only a masked fingerprint.

PRIVACY: whatever you pass here travels through this conversation and is written to its transcript on disk. For a scoped key on a test account that is usually fine. For a long-lived key, or a session token that can do everything the user can, tell the human to run this in their own terminal instead — same verification, same store, and the key never enters the conversation:

turbosign-mcp configure

Show which TurboDocx account this machine sends as.

Reports the masked API key, organization id, sender address, and where each value was resolved from — useful when the same server is installed on several machines with different accounts. With verify=True it also checks the credentials against the live API.

Return this server's usage instructions and recommended workflow.

Call this after a context compaction, or whenever it is unclear which tool to reach for.

Refresh the client's cached tool list after a server restart or upgrade. Call this instead of falling back to raw HTTP requests.

Send a document out for signature. This emails the recipients.

THERE IS NO SANDBOX — TurboSign has one environment and it is production. This reaches a real inbox and cannot be recalled, only voided. On a new machine, new document layout or new account, run turbosign_whoami(verify=True) then turbosign_review() first, and make your first real send to your own address.

turbosign_review() takes these exact arguments and emails nobody.

file_path: absolute path to a PDF (DOCX and PPTX also work, but only with an explicit anchor or fields, since they cannot be measured). recipients: "Bob Smith bob@example.com, ann@example.com", or a JSON array of {name, email} objects. placement: "auto" reads the document, uses {Signature1}-style anchors if they are there, and otherwise places a signature and date box per recipient at the foot of the last page. "anchor" requires anchors. "coordinates" forces automatic positioning. "explicit" requires a fields array. sequential: false (default) lets everyone sign at once; true makes them sign in the order listed.

Returns the document_id — keep it, every other tool needs it.

Prepare a document and get a preview URL WITHOUT emailing anyone.

Same arguments as turbosign_send. Use this to check where the signature boxes landed before committing to a real send — open the returned preview_url in a browser and look.

Worth doing the first time you send a particular kind of document.

Check where a signature request has got to.

Reports the document's state (pending, completed, voided) and, where the API returns them, each recipient's state and id. The recipient ids are what turbosign_resend() needs.

Download a completed signed document to a local file.

Only completed documents can be downloaded. output_path must be an absolute path in an existing directory.

Cancel a signature request that has not completed.

The reason is recorded in the audit trail and is required. This cannot be undone — send the document again if you need to restart.

Resend the signature request email to recipients who have not signed.

recipient_ids is a comma-separated list of recipient UUIDs — get them from turbosign_status(). Only recipients whose turn it is in the signing order will actually be emailed.

Get the tamper-evident history of a document.

Returns hash-chained entries — prepared, sent, viewed, signed, voided — newest last. Use this to answer "has Bob opened it yet?".