← Back to search

kysigned-mcp

GitHub Actions Scanned 5d ago

MCP server for kysigned — self-verifying e-signatures

npm
D
40 / 100

Versions

0.4.1latest
Jul 21, 2026
0.4.0
Jul 17, 2026
0.3.0
Jul 16, 2026
0.2.2
Jul 16, 2026
0.2.1
Jul 9, 2026
+ show 5 moreshow less
0.2.0
Jul 9, 2026
0.1.5
Jul 9, 2026
0.1.3
Jul 9, 2026
0.1.1
Jul 7, 2026
0.1.0
Jul 7, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

create_envelope
annotations: verified low

Create a new signing envelope. Sends a PDF to one or more signers (max 20); at completion every party receives a sealed evidence-bundle PDF. Provide EXACTLY ONE of pdf_base64 (≤ ~3 MB) or pdf_url (any size, fetched server-side). Consumes a creator credit and emails each signer.

message string signers array document_name string
readOnlyHint false openWorldHint true destructiveHint false
check_envelope_status
annotations: verified low

Check a signing envelope: per-signer signing status and times, plus each signer's delivery_status (pending / delivered / undeliverable — whether the signing-request email reached them, distinct from whether they signed).

envelope_id string
readOnlyHint true openWorldHint true destructiveHint false
list_envelopes
annotations: verified low

List the envelopes you (the authenticated creator) have sent, with each one's status.

readOnlyHint true openWorldHint true destructiveHint false
send_reminder
annotations: verified low

Send a reminder email to all pending signers on an envelope.

envelope_id string
readOnlyHint false openWorldHint true destructiveHint false
wallet_status
annotations: verified low

Report the payer\'s payment readiness for wallet-paid envelope creation: payer provenance (source kind +

readOnlyHint true openWorldHint true
create_envelope_x402
annotations: none low

Create a signing envelope PAYING PER ENVELOPE from the local run402 wallet via x402 — no API key and no

void_envelope
annotations: verified low

Void an active envelope. Cancels all pending signing requests and notifies signers. Irreversible.

envelope_id string
readOnlyHint false openWorldHint true destructiveHint true

Permissions 5

shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
database medium
Server uses database capabilities via: pg
network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 49

info
Tool 'create_envelope' annotations are consistent annotation_checker · 80%
info
Tool 'check_envelope_status' annotations are consistent annotation_checker · 80%
info
Tool 'list_envelopes' annotations are consistent annotation_checker · 80%
info
Tool 'send_reminder' annotations are consistent annotation_checker · 80%
info
Tool 'wallet_status' annotations are consistent annotation_checker · 80%
low
Tool 'create_envelope_x402' has no annotations annotation_checker · 100%
info
Tool 'void_envelope' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: pdfjs-dist@6.1.200 (GHSA-hq66-cqwq-w95j) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/mcp/src/wallet.ts:82 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/timestamp/fake.ts:36 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/timestamp/e2e.live.ts:28 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/bundle/evidenceManifest.ts:22 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/db/pdfBlobs.ts:46 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/pdf/nameFont.ts:61 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-11addff/src/pdf/coverPage.test.ts:29 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-11addff/src/pdf/assembleCanonicalPdf.test.ts:29 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/pdf/hash.ts:100 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/integrations/run402Http.test.ts:80 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/integrations/run402Http.test.ts:94 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/integrations/run402Http.ts:63 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-11addff/src/timestamp/ots/detached.ts:12 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/timestamp/ots/provider.ts:54 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-11addff/src/api/signing/checkReplyMembership.test.ts:12 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-11addff/src/api/signing/mimeHeaders.ts:67 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: create_envelope manifest_parser · 85%
info
Tool: check_envelope_status manifest_parser · 85%
info
Tool: list_envelopes manifest_parser · 85%
info
Tool: send_reminder manifest_parser · 85%
info
Tool: wallet_status manifest_parser · 85%
info
Tool: create_envelope_x402 manifest_parser · 85%
info
Tool: void_envelope manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (25) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 532 components sbom_generator · 100%
critical
AWS Access Key ID found in kychee-com-kysigned-11addff/src/pdf/brandLogo.ts secret_scanner · 95%
critical
AWS Access Key ID found in kychee-com-kysigned-11addff/src/pdf/fonts/dejaVuSansBold.ts secret_scanner · 95%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%