# addsign-mcp

MCP server for [AddSign](https://addsign.io) — connect Claude (or any MCP client) to your AddSign account so your AI assistant can **send documents for e-signature, track signing status, remind pending signers, and download signed PDFs** with their audit-trail hashes.

Built and maintained by [Gold Bird INC](https://addsign.io), the maker of AddSign.

## Install

Every path needs an AddSign account (free plan included) — get connection instructions tailored to your client, with your API key filled in, at **[addsign.io/settings/api](https://addsign.io/settings/api)**.

**Claude Desktop (one-click, works on the free Claude plan):** download the [Desktop Extension (.mcpb)](https://addsign.io/downloads/addsign.mcpb) and double-click it (or drag it into Claude Desktop). You'll be prompted for your API key — it's stored in your system keychain, never in a file.

**claude.ai / Claude Desktop via hosted connector (no key at all):** Settings → Connectors → Add custom connector → `https://addsign.io/api/mcp`, then authorize with your AddSign login (OAuth). Paid Claude plans.

**Claude Code:**

```bash
claude mcp add addsign --env ADDSIGN_API_KEY=sk_your_key -- npx -y addsign-mcp
```

**Any other MCP client (Cursor, VS Code, Windsurf, Gemini CLI, Codex CLI, …):**

```json
{
  "mcpServers": {
    "addsign": {
      "command": "npx",
      "args": ["-y", "addsign-mcp"],
      "env": { "ADDSIGN_API_KEY": "sk_your_key" }
    }
  }
}
```

## Tools

| Tool | What it does |
|---|---|
| `list_templates` | Your templates, their signer roles, and field summaries |
| `send_for_signature` | Create a document from a template and email it to signers (supports `dry_run` previews and idempotent retries) |
| `check_status` | Who viewed / signed / declined, with the audit trail |
| `remind` | Nudge signers who haven't signed (server-throttled) |
| `download_signed` | Short-lived URL for the signed PDF + its ledger SHA-256 |
| `list_documents` | Your documents, filterable by status (including `declined`) |

## Security posture

- **The server holds no secrets beyond your own API key**, read from the `ADDSIGN_API_KEY` environment variable only — never from prompts or tool arguments — and redacted from every error it surfaces. It speaks only AddSign's public v1 API; there is no database access.
- **No destructive tools.** An agent can send, but can never cancel or delete documents, touch account or billing settings, or see API keys. Mis-sends are corrected by the human — every agent-initiated send emails the account owner with one-click View/Cancel.
- **Server-side guardrails on every agent send:** recipient verification (deliverability, saved-contacts matching, typo detection), optional per-key contacts-only restriction, plan metering, and full audit-ledger attribution of every agent action.
- Keys are created and revoked instantly at [addsign.io/settings/api](https://addsign.io/settings/api).

## Development

```bash
npm install
npm run build        # compile TypeScript → dist/
npm run build:mcpb   # build the Claude Desktop Extension → addsign.mcpb
```

Requires Node.js ≥ 18. The `.mcpb` build bundles the server into a single file (no `node_modules` shipped) and packs it with [`@anthropic-ai/mcpb`](https://github.com/anthropics/mcpb).

This repository is the public release mirror of the server that ships as [`addsign-mcp` on npm](https://www.npmjs.com/package/addsign-mcp) and in the [official MCP Registry](https://registry.modelcontextprotocol.io) (`io.github.rmindgh/addsign-mcp`). Issues and questions are welcome here; the AddSign product itself is not open source.

## License

[MIT](./LICENSE) © Gold Bird INC