MCP server

Signater runs a Model Context Protocol (MCP) server. An AI assistant such as Claude, ChatGPT or Cursor connects to it and works with your account through tools: it reads envelopes, reports and usage, drafts and publishes envelopes, and answers questions about the account. It acts as the person who connected it, with the same permissions, plan and rate limit as the REST API.

https://api.signater.com/mcp

Use the REST API when your own systems make the calls and webhooks tell them what changed. Use MCP when a person works through an assistant and asks for things in their own words.

Connect your client

The app walks you through each client at Settings → Profile → MCP:
app.signater.com/settings/profile/mcp

Client	How it connects
Claude.ai, ChatGPT	Add `https://api.signater.com/mcp` as a custom connector. The client sends you to Signater to sign in and approve the connection, and keeps its own tokens from then on.
Claude Code	`claude mcp add --transport http signater https://api.signater.com/mcp` opens the same sign-in. To use an MCP token instead, add `--header "Authorization: Bearer YOUR_MCP_TOKEN"`.
Cursor, VS Code, Windsurf	The server URL and an `Authorization: Bearer YOUR_MCP_TOKEN` header in the client's MCP configuration.

Authentication

The server takes two kinds of credential, both in the Authorization: Bearer header.

MCP token. Create one at Settings → Profile → MCP. It is a credential of its own kind: an API token is refused on /mcp, and an MCP token is refused on the REST routes. Like an API token, it belongs to one user, one account and one environment.

OAuth connection. A request without a valid token gets 401 with a WWW-Authenticate header pointing to the protected resource metadata, which is where OAuth clients start:

https://api.signater.com/.well-known/oauth-protected-resource/mcp

That document names the authorization server, https://internal-api.signater.com. Claude.ai, ChatGPT and Claude Code are registered with Signater already; other clients can publish a client ID metadata document or register themselves. All of them are public clients using the authorization code flow with PKCE (S256), and resource must be the MCP URL. The person approves each connection on a Signater consent screen. Access tokens last one hour, and refresh tokens rotate on every use.

Every MCP token and every OAuth connection is listed at Settings → Profile → MCP, where you can revoke it.

What the assistant can do

The server offers 46 tools: 38 read and 8 write. No tool deletes anything, and members and invites are read-only. MCP tools lists every tool with the REST route it mirrors.

The assistant sees what the person behind the token sees. Members reach the vaults they belong to; administrators reach the whole account. 21 tools are for administrators only: reports, usage, webhooks, members and invites, and the account-wide lists of pending envelopes, accesses and signer actions. Every token sees the same tool list, and a member who calls one of these tools gets an error result with User should be an administrator. list_envelopes and list_templates need an administrator only with scope set to Account.

Each tool answers with the same JSON as its REST route, as text and as structured content.

Plans, limits and sandbox

MCP is available on the Business plan or above, like the API. A token from a lower plan is refused with the same message the REST API gives.

Requests to /mcp share the API's rate limit: 1,000 requests per 10-minute window, per token. Every request counts, tool calls included.

A sandbox token works on sandbox data, and the server tells the assistant it is in sandbox when it connects. get_account answers isSandbox. Read Sandbox before testing: signers still receive real e-mails, and publishing consumes an envelope from the real balance.

Errors

The 401 and 403 of the front door stay HTTP answers, as described in Authentication. Past that, a refused tool call does not fail the MCP request: the tool returns an error result whose body is the REST error body, with the HTTP status name in metadata.status.

{"errors":[{"message":"User should be an administrator.","metadata":{"status":"Forbidden"}}]}

A validation error also names the parameter in metadata.property.

Safety

The assistant reads text other people wrote. Signers fill in form fields and name the files they attach, and get_envelope returns that text. A signer can write instructions there, hoping an assistant will follow them.

Keep your client's confirmation on for write tools, so the assistant asks before it creates, changes, publishes, holds or cancels anything.

Connect with an administrator's account only when you need the administrator tools.

Revoke connections you no longer use at Settings → Profile → MCP.

Connect your client#

Authentication#

What the assistant can do#

Plans, limits and sandbox#