MCP.Market

Sign CLI MCP server

by DrBaher·io.github.DrBaher/sign-cli·v0.9.0
No reviews yet

Agent-first e-signature MCP server with offline PAdES signing and hash-chained audit.

B72/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
New

0 stars49 downloads/wk

Reviews

Write one

Nobody has reviewed Sign CLI yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Sign CLI tools (19)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • audit_scan

    Verify the audit chain of every request in the local DB (or filtered by provider/status).

  • audit_verify

    Verify the cryptographic audit chain for a request and report any break.

  • document

    One-shot DOCX|PDF → signed PDF. Mirrors `sign document`. Orchestrates DOCX→PDF

  • pdf_detect_date_field

    Detect date-field placement candidates in a PDF. Returns candidates with `alreadyFilled: true` when

  • pdf_detect_signature_field

    Detect signature-field placement candidates in a PDF (AcroForm /Sig widgets + anchor-text matches).

  • pdf_inspect_signatures

    Inspect existing PADES signatures on ANY PDF — ours, Adobe's, DocuSign's, Dropbox Sign's, SignWell's.

  • pdf_stamp_text

    Stamp a text string (e.g. a date) onto a PDF. Mirrors `sign pdf stamp-text`.

  • preview

    Stamp a signature image or rendered name onto a PDF as a draft preview — NO PAdES seal,

  • profile_list

    List the profiles configured in the user's profiles.json. Shows the active source so the agent

  • profile_show

    Show the resolved active profile (or a specific user profile by name) with per-field provenance.

  • request_receipt

    Export a cryptographically-signed receipt bundle for a request: audit.json, signed.pdf,

  • request_show

    Return the enriched request snapshot: request, approvals (with tokenHint/expiresAt/expired/signed),

  • request_status

    Poll the provider for the latest status of a request. For dropbox/signwell, reads API keys

  • request_watch

    Poll a request's status until terminal (completed/declined/canceled/timeout).

  • sign

    Sign a local signing request as the holder of the given token. Requires --provider local.

  • signer_decline

    Decline a local signing request as the holder of the given token. Sets status to declined.

  • signer_fetch_document

    Read the unsigned PDF for a local signing request. Requires the per-signer token.

  • signer_list

    List pending local-provider requests where the given signer is a recipient.

  • signer_reissue_token

    Mint a new per-signer token for an existing request; the previous token is invalidated.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

2 medium
  • Code scan87 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 75 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (2)

  • mediumnpm install lifecycle script presentinstall.script
  • mediumnpm install lifecycle script presentinstall.script
    package.json: …ation=stdout dist/tests/*.test.js", "postinstall": "node scripts/trim-pdfjs-dist.mjs || ex…
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Sign CLI compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 40% of 4,460 AI and agents servers
Tools
19
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
49
more than 41% of 1,538 AI and agents servers with a package

What its tools let an agent do: 19 read

Install Sign CLI in Claude Code, Cursor or VS Code

Runs npx -y @drbaher/sign-cli on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add sign-cli -- npx -y @drbaher/sign-cli
Add to Cursor

What the publisher says

From the Sign CLI repository's README, as published. We do not edit it. Read it on GitHub

sign-cli

Fully-offline e-signature CLI. The built-in PAdES signer (PKCS#7 in /ByteRange, self-issued cert) produces real, cryptographically verifiable signed PDFs with no signup and no third-party provider — or routes through Dropbox Sign / DocuSign / SignWell when you need an external trust anchor. Per-signer approval tokens (TTL-bounded, scoped to one email), hash-chained audit events, RFC 3161 timestamping, named profiles, a 19-tool MCP server, and a 20-route HTTP API.

The asymmetry is the architecture: an agent can drive every step except the actual signing gesture, which stays gated behind a human.

Part of the contract-ops CLI suite — optional. sign-cli works entirely on its own; it's also the signing + audit step of the contract-ops suite: template-vault-cli → draft-cli → nda-review-cli → docx2pdf-cli → sign-cli, with drift detection via compare-cli.

Run this

npx @drbaher/sign-cli demo

That single command runs the entire lifecycle — create (consent + email-verification gates on) → send → watch the gates block signing → verify email → capture consent → approve → sign → verify chain → export receipt — against the offline local provider, then deletes everything. No signup. No keys. ~5 seconds.

Live demo → — read-only, resets every 4 hours. Self-host: see deploy/README.md.

Where to go next

Concept deep-dives live in docs/reference/; task-oriented recipes in docs/recipes/.

Quick start

# Install
npm i -g @drbaher/sign-cli

# Or run without installing
npx @drbaher/sign-cli demo

# After install, the binary is named `sign`
sign --version
sign demo
sign init        # wizard: provider selection + .env
sign doctor preflight   # structured per-check readiness report

Or download a standalone binary from Releases — ./sign-linux-x64 demo. See DISTRIBUTION.md for every install path.

What this gives you

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Sign CLI: common questions

Is Sign CLI MCP server safe?
Mostly: it is graded B (72/100). Read the Sign CLI safety report
How do I install Sign CLI?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Sign CLI need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Sign CLI maintained?
The last commit was 114 days ago (2026-07-13). The latest release is v0.9.0.
What can I use instead of Sign CLI?
Servers from other publishers that do the same job: Basic Memory MCP server, HOL Guard MCP server and Agent-Native Chat MCP server.
How does Sign CLI compare with other AI and agents MCP servers?
safety score 72/100 (higher than 40% of 4,460 AI and agents servers); tools 19 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Sign CLI

Same job from other publishers: the closest match first, then the best rated.

  • Basic Memory
    Local-first knowledge management with bi-directional LLM sync via Markdown files.
    B
  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • Agent-Native Chat
    Minimal chat-first app with durable threads, actions, and the app-agent loop
    A
  • mcptoon
    MCP tools + agent skills in one zero-dependency CLI: 71,929 -> 581 tokens (-99.2%, measured).
    A
  • yutu
    CLI, MCP server, and AI agent to automate YouTube workflows
    A

More from DrBaher →