Docuseal

Manage DocuSeal document templates and e-signatures.

Security Scan

The skill's code, docs, and required environment variables are consistent with a DocuSeal MCP client and do not request unrelated credentials or perform unexpected actions.

Purpose & Capability

Name/description match the behavior: the scripts call JSON-RPC on $DOCUSEAL_URL/mcp and use DOCUSEAL_MCP_TOKEN for Authorization. No unrelated services, binaries, or config paths are required.

Instruction Scope

SKILL.md instructs the agent to set DOCUSEAL_URL and DOCUSEAL_MCP_TOKEN and run the included Node CLI. The runtime instructions and CLI behavior stay within the stated purpose (search/create/send templates and documents). There are no instructions to read other files, environment variables, or to transmit data to endpoints other than the declared DOCUSEAL_URL.

Install Mechanism

No install spec; this is instruction-only with two small JS scripts. No external downloads, package installs, or archive extraction are performed by the skill.

Credentials

The skill requires only DOCUSEAL_URL and DOCUSEAL_MCP_TOKEN, which are necessary and sufficient for the described API calls. The token is used as a Bearer auth header. No other SECRET/TOKEN/PASSWORD env vars are requested.

Persistence & Privilege

always:false and no special persistence or system-wide configuration changes. The skill can be invoked autonomously (platform default), which is expected for an integration that performs network calls on behalf of the user.

Assessment

This skill appears coherent and limited to calling your DocuSeal instance. Before installing: 1) Only provide DOCUSEAL_MCP_TOKEN for a trusted DocuSeal instance (DOCUSEAL_URL) and prefer a token scoped with least privilege. 2) Be aware create-template accepts a URL — DocuSeal may fetch that URL (verify this doesn't allow SSRF or leaking internal resources). 3) If you allow autonomous invocation, the agent can call the DocuSeal API using the token, so ensure the token's permissions are appropriate. 4) Node.js 18+ is required to run the included CLI if you intend to use it.

DocuSeal App Skill

Manage document templates and e-signatures via the DocuSeal MCP endpoint.

Setup

1. Enable MCP in DocuSeal settings (Settings > MCP)
2. Create an MCP token
3. Set environment variables:

   export DOCUSEAL_URL="https://your-docuseal-instance.com"
   export DOCUSEAL_MCP_TOKEN="your-mcp-token"
   

Protocol

All requests use JSON-RPC 2.0 over HTTP POST to $DOCUSEAL_URL/mcp.

Usage with scripts/cli.js

Requires Node.js 18+. No dependencies.

node scripts/cli.js init
node scripts/cli.js tools
node scripts/cli.js search-templates --q="contract" --limit=5
node scripts/cli.js create-template --url="https://example.com/document.pdf" --name="My Template"
node scripts/cli.js send-documents --template-id=1 --emails="[e-mail],[e-mail]"
node scripts/cli.js search-documents --q="[e-mail]" --limit=5

Commands Reference

search-templates

Search document templates by name.

Option	Type	Required	Description
--q	string	yes	Search query to filter templates by name
--limit	integer	no	The number of templates to return (default 10)

create-template

Create a template from a PDF URL.

Option	Type	Required	Description
--url	string	yes	URL of the document file to upload
--name	string	no	Template name (defaults to filename)

send-documents

Send a document template for signing to specified submitters.

Option	Type	Required	Description
--template-id	integer	yes	Template identifier
--emails	string	yes	Comma-separated list of submitter email addresses

search-documents

Search signed or pending documents by submitter name, email, phone, or template name.

Option	Type	Required	Description
--q	string	yes	Search by submitter name, email, phone, or template name
--limit	integer	no	The number of results to return (default 10)

Notes

• Requires Node.js 18+ (uses built-in fetch, no dependencies)
• All responses follow JSON-RPC 2.0 format
• DOCUSEAL_URL and DOCUSEAL_MCP_TOKEN environment variables must be set
• MCP must be enabled in account settings before use
• Token is shown only once at creation — store it securely