SignDocs Brasil MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to SignDocs Brasil document signing-session and webhook tools: Do staging defaults and OAuth credentials retain clear boundaries between preparing envelopes and executing signing actions?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Brazil-focused e-signature workflow automation with staging/production separation.

What we know

MCP adapter over the SignDocs Brasil API for signing sessions, envelopes, document uploads/downloads, evidence, webhooks and ICP-Brasil-related workflows.

Maintenance / activity evidence

@signdocs-brasil/mcp-server 0.11.2 published 2026-09-07T23:35:22.846Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Signing, envelope, document and webhook authority according to credential scope. Writes: Create/cancel signing sessions; Create envelopes/signers; Resend OTPs; Upload documents; Cancel transactions; Register/delete/test webhooks.
OAuth2 client credentials/access tokens.
Sensitive access: Contracts/PDFs, Signature evidence, Client credentials

Can initiate legally binding signatures and mutate transaction state; production should be approval-gated.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do staging defaults and OAuth credentials retain clear boundaries between preparing envelopes and executing signing actions?

The bounded review of the publisher's documented SignDocs Brasil document signing-session and webhook tools and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Can initiate legally binding signatures and mutate transaction state; production should be approval-gated.
Signing, envelope, document and webhook authority according to credential scope.
OAuth2 client credentials/access tokens.
Documents, signatures and evidence are managed by SignDocs; remote session state may be held in-process.
Reviewed write actions: Create/cancel signing sessions; Create envelopes/signers; Resend OTPs; Upload documents; Cancel transactions; Register/delete/test webhooks
Sensitive access: Contracts/PDFs, Signature evidence, Client credentials
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
public source repository
complete pricing
retention/data residency
Production actions can become legally binding.
HML staging data expires after roughly seven days.
Some SDK capabilities are not exposed.
Remote in-process session state needs sticky routing unless externalized.
No public implementation repo was proven.

Original activity observations

@signdocs-brasil/mcp-server 0.11.2 published 2026-09-07T23:35:22.846Z

Technical identity

npm/@signdocs-brasil/mcp-server

Exact implementation source: https://www.npmjs.com/package/@signdocs-brasil/mcp-server ↗
Reviewed resource type: MCP Server
Package identity: npm:@signdocs-brasil/mcp-server
Service endpoint: POST /mcp on self-hosted deployment

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@signdocs-brasil/mcp-server
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Local server exchanges OAuth2 client credentials; remote HTTP uses bearer access tokens; distinguish transports.
publisher documented install or connect · Publisher instructions
npm install -g @signdocs-brasil/mcp-server
publisher documented step or launch · Publisher instructions
npx -y @signdocs-brasil/mcp-server
Configure / authenticate
MCP100 setup guide
SignDocs requires SIGNDOCS_CLIENT_ID and SIGNDOCS_CLIENT_SECRET for OAuth client credentials. Use signature-verification read tools rather than sending signing envelopes.
Environment variables referenced by this route (respect the alternatives above): SIGNDOCS_CLIENT_ID, SIGNDOCS_CLIENT_SECRET
Check connection
Suggested check
User-side suggested check (not executed): inspect registered tools/connection and perform publisher-supported read-only status/list operations. Do not send, purchase, publish, delete, sign, trade or alter data as a smoke test.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Remove local stored keys/tokens and revoke or rotate corresponding provider authorization using documented provider account controls if available; exact procedure not verified for this package. Wallet private keys cannot be revoked.

Official Documentation & Sources

What it does

MCP adapter over the SignDocs Brasil API for signing sessions, envelopes, document uploads/downloads, evidence, webhooks and ICP-Brasil-related workflows.

Capability: Productivity & Collaboration
Resource type: MCP Server
Industry: Legal & Compliance
Best fit: Brazil-focused e-signature workflow automation with staging/production separation.

Representative uses

Create signing sessions and envelopes
Upload/download documents
Poll/cancel transactions
Resend OTPs and verify evidence
Register/test/delete webhooks

Limitations

Production actions can become legally binding.
HML staging data expires after roughly seven days.
Some SDK capabilities are not exposed.
Remote in-process session state needs sticky routing unless externalized.
No public implementation repo was proven.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: OAuth2 client credentials/access tokens.
Permissions: Signing, envelope, document and webhook authority according to credential scope.
Data handling: Documents, signatures and evidence are managed by SignDocs; remote session state may be held in-process.
Cost: quota_or_plan_based
Risk and cautions: Can initiate legally binding signatures and mutate transaction state; production should be approval-gated.

Access scope and cautions

Write actions: Create/cancel signing sessions Create envelopes/signers Resend OTPs Upload documents Cancel transactions Register/delete/test webhooks
Sensitive access: Contracts/PDFs Signature evidence Client credentials
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Create signing sessions and envelopes; Upload/download documents; Poll/cancel transactions; Resend OTPs and verify evidence; Register/test/delete webhooks.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @signdocs-brasil/mcp-server. Recorded transport: stdio, streamable_http, lambda_http. Recorded environment-variable notes: SIGNDOCS_CLIENT_ID; SIGNDOCS_CLIENT_SECRET; SIGNDOCS_ENVIRONMENT (optional); SIGNDOCS_BASE_URL (optional); SIGNDOCS_SCOPES (optional). No configuration values are supplied here. Prerequisites: SignDocs API credentials; MCP client. Client notes: Start in HML before production; use origin/DNS-rebinding protections in HTTP mode. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: OAuth2 client credentials locally; remote bearer/basic/header credential modes are documented.

Can it modify data or perform write operations?

Documented write actions include: Create/cancel signing sessions; Create envelopes/signers; Resend OTPs; Upload documents; Cancel transactions; Register/delete/test webhooks. Recorded permission boundary: Signing, envelope, document and webhook authority according to credential scope.

What data-handling boundary should I consider?

Documents, signatures and evidence are managed by SignDocs; remote session state may be held in-process. Recorded sensitive-access context: Contracts/PDFs; Signature evidence; Client credentials.

What limitations and risks should I check before use?

Can initiate legally binding signatures and mutate transaction state; production should be approval-gated. Production actions can become legally binding. HML staging data expires after roughly seven days. Some SDK capabilities are not exposed. Remote in-process session state needs sticky routing unless externalized. No public implementation repo was proven. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

SignDocs Brasil is listed as First-party MCP in MCP100’s current evidence.