# Assinafy

> Send documents for legally valid e-signature in Brazil, track signers and download signed files.

- name: io.github.assinafy/mcp-server
- version: 3.2.0
- connection class: R0 (autonomous)
- trust: 97/100
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.assinafy%2Fmcp-server
- tools: https://api.protogrid.dev/v1/servers/io.github.assinafy%2Fmcp-server/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "assinafy": {
      "type": "http",
      "url": "https://mcp.assinafy.com.br/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-98% +updated-7d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 27 of 27 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- warn `tools.token_cost`: about 8,687 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 51 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 27, about 8,687 tokens to load them all
- tool set hash: 6f1dd5000772907509b2733b23d46622
- tools last changed: 2026-10-19T20:16:47.799Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.assinafy/mcp-server.svg)](https://protogrid.dev/servers/io.github.assinafy/mcp-server)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `assinafy_review_signature_request` changed (inputSchema)
- 2026-10-19 `assinafy_place_fields` changed (inputSchema)
- 2026-10-19 `assinafy_create_document_from_template` changed (description, inputSchema)
  - before: Generate a document from a saved template and invite one signer per role, by signer ID or full name and email. Find roles with assinafy_list_templates and validate editor_fields values with assinafy_validate_fields first. This sends invitations and can consume credits.
  - after: Generate a document from a saved template and invite one signer per role, by signer ID or full name and email. Find roles with assinafy_list_templates and validate editor_fields values with assinafy_validate_fields first. DigitalCertificate signers require a virtual template without placed fields. This sends invitations and can consume credits.
- 2026-10-19 `assinafy_create_assignment` changed (description, inputSchema)
  - before: Request signatures on a document. Use `method: virtual` to sign without input fields, or `method: collect` to place input fields on specific pages. For **virtual**, the document may be in `uploaded`, `metadata_processing` or `metadata_ready`; it is promoted to `pending_signature` automatically once metadata processing completes. For **collect**, the document must be in `metadata_ready` (fields reference specific pages). `step` controls signing order: signers sharing a step sign in parallel, and the next step is notified only after the previous step completes. If supplied, every signer must supply it and values must be contiguous starting at 1. Obtain signer IDs from assinafy_list_signers or assinafy_create_signer and page IDs from assinafy_get_document. This sends signing invitations. Check with assinafy_get_document that no assignment exists first; this can consume credits.
  - after: Request signatures on a document. Use `method: virtual` to sign without input fields, or `method: collect` to place input fields on specific pages. DigitalCertificate signers require `method: virtual`; other methods fail with code `digital_certificate_requires_virtual`. For **virtual**, the document may be in `uploaded`, `metadata_processing` or `metadata_ready`; it is promoted to `pending_signature` automatically once metadata processing completes. For **collect**, the document must be in `metadata_ready` (fields reference specific pages). `step` controls signing order: signers sharing a step sign in parallel, and the next step is notified only after the previous step completes. If supplied, every signer must supply it and values must be contiguous starting at 1. Obtain signer IDs from assinafy_list_signers or assinafy_create_signer and page IDs from assinafy_get_document. This sends signing invitations. Check with assinafy_get_document that no assignment exists first; this can consume credits.
- 2026-10-16 `assinafy_update_signer` changed (inputSchema)
- 2026-10-16 `assinafy_send_pdf_for_signature` changed (inputSchema)
- 2026-10-16 `assinafy_review_signature_request` changed (inputSchema)
- 2026-10-16 `assinafy_resend_notification` changed (inputSchema)
- 2026-10-16 `assinafy_place_fields` changed (inputSchema)
- 2026-10-16 `assinafy_list_documents` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/io.github.assinafy%2Fmcp-server/changes

## Remotes

- https://mcp.assinafy.com.br/mcp (streamable-http, auth none, reachable true, uptime30d 0.9791667)

## Packages

_none_

## Tools (27)

- `assinafy_create_assignment`: Request signatures on a document. Use `method: virtual` to sign without input fields, or `method: collect` to place input fields on specific pages. DigitalCertificate signers require `method: virtual`; other methods fail with code `digital_certificate_requires_virtual`.

For **virtual**, the document may be in `uploaded`, `metadata_processing` or `metadata_ready`; it is promoted to `pending_signature` automatically once metadata processing completes. For **collect**, the document must be in `metadata_ready` (fields reference specific pages).

`step` controls signing order: signers sharing a step sign in parallel, and the next step is notified only after the previous step completes. If supplied, every signer must supply it and values must be contiguous starting at 1. Obtain signer IDs from assinafy_list_signers or assinafy_create_signer and page IDs from assinafy_get_document. This sends signing invitations. Check with assinafy_get_document that no assignment exists first; this can consume credits.
- `assinafy_create_document_from_template`: Generate a document from a saved template and invite one signer per role, by signer ID or full name and email. Find roles with assinafy_list_templates and validate editor_fields values with assinafy_validate_fields first. DigitalCertificate signers require a virtual template without placed fields. This sends invitations and can consume credits.
- `assinafy_create_signer`: Create a signer in the workspace. Search with assinafy_list_signers first to avoid duplicates. Sends no invitation.
- `assinafy_delete_document`: Delete a document only when the user's instruction explicitly authorizes deletion. Inspect its current state first; Assinafy enforces which documents may be deleted.
- `assinafy_download_document`: Download a document artifact as base64: original (default), certificated, certificate-page, pades or bundle. Download the signed PDF only when the document is certificated and the artifact is listed.
- `assinafy_download_document_page`: Download the rendered image of a specific document page. Use a page_id returned by assinafy_get_document. Returns base64.
- `assinafy_get_document`: Inspect one known document: status, assignment, signers with their progress, pages and available artifacts. Read it before retrying a send or following up. 100% signed does not mean certification is finished; the signed PDF is ready at status certificated.
- `assinafy_get_field`: Retrieve a single field definition.
- `assinafy_get_signer`: Retrieve a signer's information.
- `assinafy_get_template`: Get one saved template with its roles and field placements.
- `assinafy_list_document_activities`: List the activities recorded for a document. Each entry carries an event-specific `payload` snapshot (keys vary per event) and the request `origin` (`ip`, `user-agent`). Use it to explain what happened to a document and when.
- `assinafy_list_documents`: Search workspace documents by name or status, with pagination. Use it to find a document the user names before inspecting or following up on it.
- `assinafy_list_fields`: List the field definitions of a workspace.

When `include_standard` is enabled, records of type `signature`, `initial` and `signatureDate` are also returned. Match definitions to template placement field_id and ask about ambiguous names.
- `assinafy_list_signers`: List the signers of a workspace. Use it to resolve a recipient to a signer ID; ask the user about ambiguous matches before sending.
- `assinafy_list_templates`: List saved templates with their signer roles, pages and field placements (field_id). Template authoring is done in Assinafy.
- `assinafy_list_whatsapp_notifications`: List all WhatsApp notification messages sent for an assignment. The response includes the rendered template text split into `header`, `body` and `buttons` — exactly what the signer would see. In sandbox/stage, WhatsApp messages are simulated (no real delivery) and button URLs include access/verification codes you can use to simulate the signing flow. Treat returned signing links and verification codes as sensitive; never use them to sign for another person. Use it to troubleshoot WhatsApp delivery for one assignment.
- `assinafy_place_fields`: Open a visual editor to place signature, initials, date and input fields on a metadata_ready document, then send it with method collect. Takes the assinafy_create_assignment arguments except method and entries. Sends nothing by itself: in apps-capable hosts the user places fields and presses Send; other clients get page sizes and field IDs as text to build entries.
- `assinafy_rename_document`: Update a document's name. Only allowed before any assignment is created (i.e. while the document is in `uploaded` or `metadata_ready` status and has no signers yet); once the signature process has started or the document is certificated, the name is locked. The name is normalized: diacritics are removed and unsupported characters are replaced with dashes.
- `assinafy_resend_notification`: Send one reminder to a pending signer in the assignment's active step, after confirming with assinafy_get_document that they have not signed. May consume notification credits; never repeat a reminder only because progress is unchanged.
- `assinafy_review_signature_request`: Preview an assinafy_create_assignment call without sending anything: same arguments, checked against the document and signers. Use it when the user wants to review before sending. Apps-capable hosts render a card whose Send button performs the request; other clients get the summary as text, and the request is sent only after the user confirms.
- `assinafy_send_pdf_for_signature`: Upload a new PDF, wait for processing and invite signers by full name and email, using Email verification and notification. This sends invitations and uses plan allowance: use only recipients the user authorized. After a partial failure, inspect the retained document ID and continue with assinafy_create_assignment instead of uploading again.
- `assinafy_set_assignment_expiration`: Change when an existing signature request expires, using an RFC 3339 timestamp. Assinafy may refuse for requests that already expired.
- `assinafy_show_document`: Show a status card for one known document: its status, who has signed, who is still pending and when it expires. Apps-capable hosts render it with a reminder button; other clients get the same summary as text. Resolve the document with assinafy_list_documents first.
- `assinafy_update_signer`: Update a signer's information.

**Verification integrity:** `email` / `whatsapp_phone_number` cannot be changed while the signer has verified that channel on an in-flight (not yet certificated) document — the response is `400` naming the offending document(s). Already-certificated documents do not block updates. Changing a channel that has *unverified* in-flight requests rotates their access/verification codes (invalidating previously sent links/OTPs); use the resend endpoint to redeliver. `full_name` can always be updated.
- `assinafy_upload_document`: Upload a PDF without sending invitations and return its document ID. Use it when the user wants to prepare a document now and send it later with assinafy_create_assignment. Never upload again when a document ID is already known.
- `assinafy_validate_fields`: Validate one or more input values against existing field definitions without creating a document or requesting signatures. Supply field/value pairs in values; the server sends the documented JSON array. Check each result's success before requesting signatures.
- `assinafy_verify_document`: Verify a signed document using its actual Assinafy SHA-1 signature hash. Public lookup; requires no workspace connection and sends no credential upstream.