Signathing MCP Server

Signathing MCP server

Send PDFs for e-signature from any AI agent, with ESIGN and UETA consent captured on every signature, and get back a certified copy whose history anyone can verify without trusting the sender or Signathing.

• Remote server: https://signathing.com/api/mcp (Streamable HTTP). Sign in with OAuth, or send an API key as a bearer header.
• Free tier: 100 documents a month, no card. Then $0.06 a document (101 to 500), $0.03 (501 to 3,000), $0.025 (3,001+), prepaid.
• Evidence: every signing event is appended to a public hash chain, sealed daily and archived with the Internet Archive. signathing.com/transparency
• Docs: signathing.com/developers · OpenAPI: /api/v1/openapi.json · /llms.txt

Operated by AllContraX LLC, Kentucky, USA. The Signathing app and website stay free for people; the API and MCP server are for software.

Tools

Connect

Claude.ai, ChatGPT, Grok apps (OAuth)

Add a custom connector / remote MCP server with the URL https://signathing.com/api/mcp. You will be sent to signathing.com to sign in and approve. Disconnect any time under API in your Signathing dashboard.

Claude Code

claude mcp add --transport http signathing https://signathing.com/api/mcp \
  --header "Authorization: Bearer sk_live_..."

Or without a key, using OAuth: claude mcp add --transport http signathing https://signathing.com/api/mcp and run /mcp to sign in.

Cursor, VS Code, Windsurf (mcp.json)

{ "mcpServers": { "signathing": {
    "url": "https://signathing.com/api/mcp",
    "headers": { "Authorization": "Bearer sk_live_..." } } } }

Grok (xAI Responses API)

{ "type": "mcp", "server_label": "signathing",
  "server_url": "https://signathing.com/api/mcp",
  "headers": { "Authorization": "Bearer sk_live_..." } }

Claude API (Messages API, mcp_servers)

{ "type": "url", "name": "signathing", "url": "https://signathing.com/api/mcp",
  "authorization_token": "sk_live_..." }

stdio-only clients

This repository ships a dependency-free bridge for clients that cannot speak HTTP MCP:

{ "mcpServers": { "signathing": {
    "command": "npx", "args": ["-y", "github:jacejb/signathing-mcp"],
    "env": { "SIGNATHING_API_KEY": "sk_live_..." } } } }

Create a key at signathing.com/dashboard/api.

Why a third party instead of letting the agent sign things itself

A signature only matters on the day it is disputed. On that day the party that controlled the signing system is the party with something to gain, and its own logs are "trust me." Signathing is nobody's party to the contract, and it does not ask you to trust it either: every signing event goes into one public hash chain, each entry commits to the private details through a hash without publishing them, each day is sealed and archived by the Internet Archive, and the verifier in verifier/ recomputes all of it from a document's evidence package.

node verifier/verify-signathing.mjs evidence.json original.pdf signed.pdf

Example: the whole loop, verified

examples/agent-loop.mjs (Node 18+, no dependencies, public domain) sends a PDF, waits for the signature, pulls the evidence package and the certified PDF, recomputes every hash and chain entry, confirms each entry against the public log, and resolves the verification code publicly. It is the loop an agent should run before it treats an agreement as done.

SIGNATHING_API_KEY=sk_live_... node examples/agent-loop.mjs --name "Pat Lee" --email pat@example.com

[2] Send for signature
  ok   document 71 (sent); billing {"charged_tenths":0,"unit_this_month":1}
  ok   server's original_sha256 matches the bytes we sent
[3] Waiting for Pat Lee to sign (up to 30 min)
  ok   completed at 2026-10-26T02:02:00Z; signed PDF SHA-256 afe6...; sealed=true
[4] Evidence package and certified PDF
  ok   signed PDF hashes to document.signed_sha256
[5] Independent verification
  ok   event 609 completed -> chain seq 589
  ok   seq 589 is identical in the public log
  ok   public log slice 583 to 590 recomputes end to end
[6] Public checks anyone can repeat
  ok   verification code resolves publicly to this document and its signed hash
VERIFIED: document 71, 6 events, all hashes and public-log entries recomputed.

With MCP it is four tool calls: send_document, get_document (or the document.completed webhook), get_evidence, then the verifier on what came back. The day's seal, Internet Archive snapshot and OpenTimestamps proof arrive after midnight UTC; a second verifier run the next day checks those too.

Example: an agent sends a lease

User: Send the lease at https://files.example.com/lease.pdf to Pat Lee (pat@example.com) for signature.
Agent -> send_document { file_url, title: "Lease", signers: [{ name: "Pat Lee", email: "pat@example.com" }] }
Signathing -> { id: 58, status: "sent", signers: [{ signing_url: "https://signathing.com/sign/..." }], billing: { charged_tenths: 0 } }

Pat gets an email, signs in the browser, and the agent can call get_document or receive a webhook. The certified PDF is digitally sealed and carries a certificate page and a verification code per signature.

License

MIT for this repository. The Signathing service has its own terms and privacy policy.