← Back to search

kysigned-mcp

GitHub Actions Scanned 18d ago

MCP server for kysigned — self-verifying e-signatures

npm
D
40 / 100

Versions

0.4.1latest
Jul 21, 2026
0.4.0
Jul 17, 2026
0.3.0
Jul 16, 2026
0.2.2
Jul 16, 2026
0.2.1
Jul 9, 2026
+ show 5 moreshow less
0.2.0
Jul 9, 2026
0.1.5
Jul 9, 2026
0.1.3
Jul 9, 2026
0.1.1
Jul 7, 2026
0.1.0
Jul 7, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 10

create_envelope_x402
annotations: none low

readOnlyHint false openWorldHint true destructiveHint true
create_envelope
annotations: verified low

Create a new signing envelope. Sends a PDF to one or more signers (max 20); at completion every party receives a sealed evidence-bundle PDF. Provide EXACTLY ONE of pdf_base64 (≤ ~3 MB) or pdf_url (any size, fetched server-side). Consumes a creator credit and emails each signer.

message string signers array document_name string
readOnlyHint false openWorldHint true destructiveHint false
check_envelope_status
annotations: verified low

Check a signing envelope: per-signer signing status and times, plus each signer's delivery_status (pending / delivered / undeliverable: whether the signing-request email reached them, distinct from whether they signed).

envelope_id string
readOnlyHint true openWorldHint true
list_envelopes
annotations: verified low

List the envelopes you (the authenticated creator) have sent, with each one's status.

readOnlyHint true openWorldHint true destructiveHint false
send_reminder
annotations: verified low

Send a reminder email to all pending signers on an envelope.

envelope_id string
readOnlyHint false openWorldHint true destructiveHint false
wallet_status
annotations: verified low

Report the payer\'s payment readiness for wallet-paid envelope creation: payer provenance (source kind +

readOnlyHint true openWorldHint true
void_envelope
annotations: verified low

Void an active envelope. Cancels all pending signing requests and notifies signers. Irreversible.

envelope_id string
readOnlyHint false openWorldHint true destructiveHint true
verify_bundle
annotations: verified low

pdf_base64 string
readOnlyHint true openWorldHint true destructiveHint false
explain_kysigned
annotations: verified low

Explain kysigned: how signing by forwarding an email works, the price, every way to create and pay for an envelope, how to track it, and how to verify the evidence bundle on your own machine. Free, no network call.

readOnlyHint true openWorldHint false
check_price
annotations: verified low

This instance's live per-envelope price, read from the x402 create route's own unpaid challenge: amount, asset, network and payee. Free; never pays or creates anything.

readOnlyHint true openWorldHint true

Permissions 5

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
database medium
Server uses database capabilities via: pg
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 57

info
Tool 'create_envelope_x402' annotations are consistent annotation_checker · 80%
info
Tool 'create_envelope' annotations are consistent annotation_checker · 80%
info
Tool 'check_envelope_status' annotations are consistent annotation_checker · 80%
info
Tool 'list_envelopes' annotations are consistent annotation_checker · 80%
info
Tool 'send_reminder' annotations are consistent annotation_checker · 80%
info
Tool 'wallet_status' annotations are consistent annotation_checker · 80%
low
Tool 'create_envelope_x402' has no annotations annotation_checker · 100%
info
Tool 'void_envelope' annotations are consistent annotation_checker · 80%
info
Tool 'verify_bundle' annotations are consistent annotation_checker · 80%
info
Tool 'explain_kysigned' annotations are consistent annotation_checker · 80%
info
Tool 'check_price' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: pdfjs-dist@6.1.200 (GHSA-hq66-cqwq-w95j) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.7 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/mcp/src/webPay.ts:127 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/mcp/src/verifyTool.test.ts:305 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/mcp/src/verifyBundle.ts:56 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/bundle/evidenceManifest.ts:22 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/pdf/nameFont.ts:61 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-63427f3/src/pdf/coverPage.test.ts:29 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/pdf/hash.ts:100 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-63427f3/src/pdf/assembleCanonicalPdf.test.ts:29 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/db/pdfBlobs.ts:46 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/integrations/run402Http.test.ts:80 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/integrations/run402Http.test.ts:94 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/integrations/run402Http.ts:63 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/timestamp/fake.ts:36 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/timestamp/e2e.live.ts:28 entropy_analyzer · 75%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/api/signing/mimeHeaders.ts:67 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-63427f3/src/api/signing/checkReplyMembership.test.ts:12 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/src/timestamp/ots/provider.ts:54 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in kychee-com-kysigned-63427f3/src/timestamp/ots/detached.ts:12 entropy_analyzer · 70%
medium
Buffer.from base64 in kychee-com-kysigned-63427f3/cli/test/local.test.mjs:95 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: create_envelope_x402 manifest_parser · 85%
info
Tool: create_envelope manifest_parser · 85%
info
Tool: check_envelope_status manifest_parser · 85%
info
Tool: list_envelopes manifest_parser · 85%
info
Tool: send_reminder manifest_parser · 85%
info
Tool: wallet_status manifest_parser · 85%
info
Tool: void_envelope manifest_parser · 85%
info
Tool: verify_bundle manifest_parser · 85%
info
Tool: explain_kysigned manifest_parser · 85%
info
Tool: check_price manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (26) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 546 components sbom_generator · 100%
critical
AWS Access Key ID found in kychee-com-kysigned-63427f3/src/pdf/brandLogo.ts secret_scanner · 95%
critical
AWS Access Key ID found in kychee-com-kysigned-63427f3/src/pdf/fonts/dejaVuSansBold.ts secret_scanner · 95%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%