Back to Browse

Penlydoc MCP Server

Developer ToolsUse Caution4.6MCP RegistryLocal
Free

Server data from the Official MCP Registry

Send documents for e-signature, track who signed and save sealed PDFs with PenlyDoc.

About

Send documents for e-signature, track who signed and save sealed PDFs with PenlyDoc.

Security Report

4.6
Use Caution4.6High Risk

The PenlyDoc server requires a bearer API key from the environment, has no hardcoded secrets, uses no shell execution, and its network and file permissions match its e-signature purpose. The main concern is that verify_pdf uploads any local file path to a remote endpoint without authentication, and file reads in send_document and verify_pdf are not restricted to a specific directory, so a prompt-injected assistant could exfiltrate local files. Supply chain analysis found 6 known vulnerabilities in dependencies (0 critical, 4 high severity). Package verification found 1 issue.

3 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

What You'll Need

Set these up before or after installing:

PenlyDoc API key (console → Developers)Required

Environment variable: PENLY_API_KEY

PenlyDoc instance URLOptional

Environment variable: PENLY_URL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-orestklymko-penlydoc-mcp": {
      "env": {
        "PENLY_URL": "your-penly-url-here",
        "PENLY_API_KEY": "your-penly-api-key-here"
      },
      "args": [
        "-y",
        "penlydoc-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

PenlyDoc MCP server

Let an AI assistant send documents for e-signature with PenlyDoc and follow them: "Send the lease to Mia Novak from the Residential lease template, rent 950 EUR", "Who still has to sign order 42?", "Save the signed contract to ./signed".

It is a Model Context Protocol server that runs on your computer (stdio) and talks to the PenlyDoc REST API with your organisation's API key. Works with any MCP client.

Setup

  1. Create an organisation at penlydoc.com (free) and copy an API key from Console → Developers.
  2. Add the server to your MCP client's configuration:
{
  "mcpServers": {
    "penlydoc": {
      "command": "npx",
      "args": ["-y", "penlydoc-mcp"],
      "env": { "PENLY_API_KEY": "sk_…" }
    }
  }
}

Node.js 18.17 or newer is needed. PENLY_URL points the server at another PenlyDoc instance (default https://penlydoc.com).

Treat the API key like a password: it can send documents in your organisation's name. Give the assistant a key of its own, so you can revoke it in the console without touching your other integrations.

Tools

ToolWhat it doesSide effects
get_organisationWhich organisation the key belongs to, sending limitnone
list_templatesTemplates with their roles and data keysnone
send_from_templateCreate a document from a template; send: true e-mails the peoplee-mails real people
send_documentUpload local PDFs or photos and create a document; boxes from {{sig:1}} tags or coordinatese-mails real people when send: true
list_documentsDocuments with status and who has signed; filter by status or your referencenone
get_documentOne document: each person, opened, signed or declined, and whennone
get_historyHash-chained history with times and IP addressesnone
send_draftSend a drafte-mails real people
send_reminderRemind everyone whose turn it ise-mails real people
cancel_documentVoid a document that is still being signedcannot be undone
create_signing_linkOne-hour link for an embedded signerthe link signs as that person
download_signed_pdfSave the sealed PDF of a completed document to a filewrites a local file (never overwrites)
verify_pdfCheck a signed PDF: seal intact, who signednone, no key needed

The server tells the assistant to confirm people, e-mail addresses and documents with you before anything is sent. Most MCP clients also ask you before each tool call; keep that on for the tools that e-mail people.

Learn more

MIT licensed.

Reviews

No reviews yet

Be the first to review this server!