Loading ToolBench
MCP server for SignRequest document signing API, deployable as a Cloudflare Worker with bearer token or OAuth authentication
Strong foundation with 19 well-named tools, comprehensive schemas, and detailed parameter descriptions. Tool names follow verb_noun convention (signrequest_create, signrequest_get, signrequest_send). All tools have descriptions (avg ~150 chars, within 10-1024 baseline). Input schemas are complete with Zod validation and type definitions. Key strengths: clear risk annotations (READ_ONLY, WRITE, DESTRUCTIVE), helper functions for field extraction and signer selection, and error normalization via SignRequestError handling. Gaps: output schemas not formally documented in code (inferred from ok/fail helpers), some parameter descriptions could be more prescriptive about constraints (e.g., timeout_seconds lacks min/max), and the raw_api tool (signrequest_raw_api) is a footgun that bypasses safety patterns.
Send signature requests to multiple signers in parallel (with bounded concurrency). Each signer gets their own document. Useful for campaigns.
Bulk-check the signing status of multiple signers across all documents. Returns a summary for each email: matched documents, signing status, and extracted fields.
Cancel a signature request by UUID. Signers will no longer be able to sign.
Create a document (without sending a signature request). Returns the document UUID. Useful if you want to send the request later or in a custom way.
Create a document and return embed_urls (direct signing links) for each signer WITHOUT sending emails. Useful for embedding signing flows in your app.
signrequest_raw_api bypasses safety patterns and risk annotations. Allows arbitrary HTTP methods and paths, defeating the purpose of structured tool definitions. LLMs cannot reason about consequences of raw API calls.
Output schemas not formally documented. Code uses ok()/fail() helpers that return generic text responses. LLMs cannot parse structured fields from responses (e.g., document UUIDs, signer status) without explicit schema documentation.
Numeric parameters lack min/max constraints. timeout_seconds, page, and order parameters have no documented bounds. LLMs may pass absurd values (page=999999, timeout_seconds=0).
Pagination not fully specified. signrequest_list_all_documents accepts 'page' but does not document page size, total count, or whether results are capped. LLMs cannot determine if they need multiple calls.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | <=2025-11-25 | v2 |
Permanently delete a document and all its signature requests. This is irreversible.
Fetch a document by UUID and extract the filled form fields from a specific signer (or auto-pick the most relevant one).
Fetch one or more documents by UUID (comma-separated list) and return a compact summary of each.
Fetch a document by UUID and return the signed PDF URL (if available) and signing log URL.
Look up a signer by email across all documents and return a summary: their signing status, matched documents, and extracted form fields.
Fetch a document by UUID and return the embed_url (direct signing link) for a specific signer (or auto-pick the most relevant one).
List all documents in the team (paginated). Returns a compact summary of each.
Fetch a template by UUID and list all its form fields (name, type, required, etc.).
Create a document AND send the signature request in one call. The most common entry point. Provide a document source (file_from_url preferred, or base64 file_from_content + name, or a template URL) and at least one signer. Sends real emails.
Make a raw HTTP request to the SignRequest API. Advanced users only. Specify method, path, and optional JSON body.
Resend the signature request email to all signers for a given request UUID.
Send a signature request for an already-created document. Specify the document UUID and signers.
Poll a document until it is signed (or a timeout is reached). Useful for workflows that need to wait for completion.
Validate the SignRequest API token and return the authenticated team's info.
Error handling relies on SignRequestError normalization but does not provide recovery guidance. Errors return status code + body; LLMs cannot infer whether to retry, ask user, or abort.