Docusign MCP

• Analyzed: May 5, 2026, 5:36 PM
• Findings: 1
• Version: 1.0.0
• Hash: a80dcf65824029eeabda4111428c2f9e8e468af521772da030665519cc6e4334
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a legitimate integration for managing DocuSign via a hosted MCP server. The included scripts (init-mcporter.sh and invoke.sh) are well-structured utilities designed to seed OAuth credentials into the mcporter vault (~/.mcporter/credentials.json) from environment variables. The implementation demonstrates good security hygiene, such as using flock for concurrency, passing secrets to jq via environment variables to avoid process-list exposure, and using SHA-256 hashes to track credential rotation without storing raw tokens in sidecar files. All network traffic is directed to the official DocuSign endpoint (mcp.docusign.com).