Name: Conecto E-signature
Author: conecto

Conecto E-signature MCP

PDFs signed in the browser and sealed with a signing certificate. Pay per action.

Tool-list grade A Remote · Streamable HTTP OAuth 2.1 38 tools v1.0.0

No reviews yet by conecto The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

PDFs signed in the browser and sealed with a signing certificate. Pay per action.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http conecto-e-signature-mcp https://api.conecto.chat/mcp/esign

# 2 — ask your agent for something these tools do
#   esign_send, esign_get, esign_list and 35 more

Its address takes API_KEY (Your Conecto key, sent as Bearer conecto_sk_... One POST to https://api.conecto.chat/v1/signup returns a key with $1 of free credit. Chat apps that sign in…) in the Authorization header: add it to the entry your client keeps for it.

Conecto E-signature costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

conecto11 servers

7 categories

All 11 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Its publisher asks you to sign in with OAuth: run /mcp in Claude Code and pick this server, and it opens a browser for that once.

claude mcp add --scope user --transport http conecto-e-signature-mcp https://api.conecto.chat/mcp/esign

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — the only sign-in is its publisher’s own, with OAuth.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: Authorization header — Your Conecto key, sent as Bearer conecto_sk_... One POST to https://api.conecto.chat/v1/signup returns a key with $1 of free credit. Chat apps that sign in with OAuth add https://api.conecto.chat/v1/mcp instead: one connection for every area.. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

38 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Send a PDF from the file store to up to 10 people to sign. A person's own document reaches the store through files_upload_link's page_url; a new one is written with documents_create_pdf (Markdown or HTML). Never type a PDF out as base64. Each signer gets an email with their own link, signs in the browser by drawing or typing, and everyone gets the signed PDF with a signing certificate. Without fie

Parameter	Type	Required	Notes
file_id	string	yes	A PDF in the file store.
title	string	yes	What signers see, e.g. "Service agreement".
signers	array	yes	—
fields	array	no	—
message	string	no	A note to the signers, shown in the email and on the signing page.
order	string	no	—
expires_in_days	integer	no	—

Where a signature request stands: each signer's status (waiting, to sign, opened, signed, declined), and once everyone has signed, the signed PDF with its download link. Free.

Parameter	Type	Required	Notes
request_id	string	yes	The request_id esign_send returned.

Signature requests, newest first, optionally only those with one status. Free.

Parameter	Type	Required	Notes
status	string	no	—
limit	integer	no	—

The signing link of one signer, to hand over yourself (in a chat, say). Anyone with the link can sign as that person, so give it only to them. A key that only reads or drafts gets it as "[redacted]"; esign_remind emails everyone still to sign their own link. Free.

Parameter	Type	Required	Notes
request_id	string	yes	The request_id esign_send returned.
email	string	yes	—

Email everyone who still has to sign a reminder with their link. At most once a day per request. Costs $0.02 per call; nothing if it fails.

Parameter	Type	Required	Notes
request_id	string	yes	The request_id esign_send returned.

Stop a request before everyone has signed. Signers who were asked get a short email saying nothing is needed any more; their links stop working. Free.

Parameter	Type	Required	Notes
request_id	string	yes	The request_id esign_send returned.
reason	string	no	—

Save a PDF from the file store once, with its fields placed per signer role (page, x, y, width and height in percent of the page, as in esign_send), so contracts, NDAs and waivers go out later without placing a field again. roles names who signs, in order; every role needs a signature field. Saving a name again replaces it. $0.001. Costs $0.001 per call; nothing if it fails.

Parameter	Type	Required	Notes
name	string	yes	The template's name, like service-agreement.
file_id	string	yes	A PDF in the file store.
title	string	yes	What signers see, e.g. "Service agreement".
roles	array	yes	Who signs, in order, e.g. ["Customer", "Hansen & Voss"].
fields	array	yes	—
message	string	no	The note to signers each time.
order	string	no	—
expires_in_days	integer	no	—

The saved templates: their names, titles, roles and fields. Free.

No parameter schema on file.

Send a saved template to new signers, one per role in the template's order: signers for one request, or sets for up to 50 at once (one request each, e.g. the same NDA to every new contractor). Each works like esign_send: emails, links, the signed PDF with its certificate. $0.20 per request sent. Costs $0.20 per request sent; nothing if none are found.

Parameter	Type	Required	Notes
template	string	yes	The template's name, like service-agreement.
signers	array	no	—
sets	array	no	Several requests at once: each set is one request's signers.
title	string	no	Instead of the template's title.
message	string	no	Instead of the template's note.
expires_in_days	integer	no	—

Delete a saved template. Requests already sent from it are not touched. Free.

Parameter	Type	Required	Notes
template	string	yes	The template's name, like service-agreement.

The account balance, how much of it is credit bought (AI visibility and the phone run only on that) and how much free and bonus credit, what running calls are holding, this key's daily budget, the auto-reload state, and how much of this month's free reads and downloads is used. Free.

No parameter schema on file.

One call by id: its status (queued, running, succeeded, failed), cost and result. Use it to poll a background call until it finishes. Free.

Parameter	Type	Required	Notes
call_id	string	yes	—

Recent calls on this account, newest first, optionally only failed or succeeded ones, or one area's. Free.

Parameter	Type	Required	Notes
status	string	no	—
area	string	no	—
limit	integer	no	—

Refund a top-up paid in the last 24 hours that none of has been used yet: its credit, with the first top-up's bonus, leaves the balance, and the card gets the credit back with its tax. The service fee is kept. Without topup_id, the newest top-up (GET /v1/topups lists them with their ids). Free. Free.

Parameter	Type	Required	Notes
topup_id	integer	no	—

When the account was made without the owner's email: send that person a link to confirm they own it. Once they confirm, the owner gets the account's warnings and approval requests, and only the owner raises limits. Nothing changes until they open the link. Free. Free.

Parameter	Type	Required	Notes
email	string	yes	—

A link that signs the business owner into their Conecto page, with no password: the balance, adding credit, auto-reload, limits, what the bots did, people, rentals and keys. page opens it where the owner is needed, like people for a role only the owner gives, or settings for joining by email domain. It works once, within 30 minutes; hand it to the owner. Free.

Parameter	Type	Required	Notes
page	string	no	—

A one-time link to a page showing one area as it is when the page opens, for when the person you work for asks to see it themselves: a recruiter looks at the applicants, a bookkeeper at what is due. Do the work and answer with the area's own tools first; a link never replaces that. When an answer would be a long list they would rather look through, offer a link and make it once they say yes. The p

Parameter	Type	Required	Notes
area	string	yes	—

The limits a business can ask Conecto to raise (calls a minute, new email addresses a day, phone numbers and more): each one's standard and current value and the most that can be asked for, and the business's requests with their answers. Free.

No parameter schema on file.

Ask Conecto to raise one of the business's limits: which one (or other, saying which), the number it needs, and why, in 40 to 2,000 characters. Conecto reviews it and approves (maybe with less) or declines; the answer comes as the account.limit_request_answered event and by email to the owner, who is also told now. For an account that has topped up; one request per limit at a time, five in 30 days

Parameter	Type	Required	Notes
limit	string	yes	The limit, as account_get_limits names it, or other.
amount	integer	yes	The number the business needs, in the limit's unit (5000 calls a minute).
reason	string	yes	What the business does that needs it, and why the current limit is too low.
other	string	no	With limit other: which limit, like "rows in one table".

What happened in this account that someone outside the bot did, oldest first: applications, bookings, form responses, signatures, replies, emails received, goals reached on the website; and the custom events bots sent with account_emit_event. Kept 30 days. Poll with after = the last event_id you saw. Free.

Parameter	Type	Required	Notes
after	integer	no	Only events after this event_id.
kinds	array	no	Event names or areas ("hiring.*"); all when left out.
limit	integer	no	—

Send an event you name, custom.<name> (custom.lead_qualified, custom.order_shipped), to every channel subscribed to it (notify_subscribe with "custom.*" or its name: Slack, Teams, a webhook to Zapier, Make, n8n or the business's own systems) and to account_events, where another team's bot can pick it up. data is any JSON object (up to 10 KB); sent_by is added with this bot's name and team. $0.005

Parameter	Type	Required	Notes
kind	string	yes	custom. and a name of lowercase letters, digits, dots, dashes and _.
title	string	yes	—
text	string	no	—
data	object	no	—
link	string	no	—

One search over what this account holds: what its files say (PDFs, Word, Excel, PowerPoint, text), table rows, help center articles, CRM contacts, companies and deals, emails, tickets, quotes and invoices, book entries, stock items and project tasks. Every word must appear (any case); titles rank first, then the newest. Each result says which tool opens it. Narrow it with areas. Free.

Parameter	Type	Required	Notes
query	string	yes	—
areas	array	no	—
limit	integer	no	—

The name, logo, colour and footer line the business's emails and published pages carry. Free.

No parameter schema on file.

The business's name as the sender, its logo (a PNG, JPEG, WebP or GIF from the file store), its colour and a footer line (an address, a legal line), on every email to its customers (bookings, applications, tests, signatures, invoices, newsletters, replies) and on its published pages (forms, booking, careers, newsletters, status, views). Only what you pass changes; an empty string clears it. Mail f

Parameter	Type	Required	Notes
sender_name	string	no	—
logo_file_id	string	no	—
remove_logo	boolean	no	—
colour	string	no	Hex, like #1a73e8; empty for none.
footer	string	no	—

Every email Conecto sends to the business's customers (bookings, applications, interviews, tests, signatures, invoices and quotes, newsletter sign-ups), with when it goes out and its subject, headline and opening words as they are now, and the {variables} each can use. Free.

No parameter schema on file.

Change an email's subject, headline or opening words in the business's own voice, with {variables} from account_list_email_templates (like {name} or {when}). The facts under them (times, places, amounts, links and buttons) stay as they are. Only what you pass changes; an empty string brings back the original words. Plain text; a blank line starts a new paragraph. Costs $0.001 per call; nothing if

Parameter	Type	Required	Notes
email	string	yes	Like booking_booked or invoice_sent.
subject	string	no	—
headline	string	no	—
opening	string	no	—

Everything this account holds, in ZIP files of up to 24 MB saved to its file store: every record of every area as JSON Lines, and the stored files themselves, with a README saying what is where. Credentials are left out. Runs in the background: poll the call with account_get_call; the result has a download link for each part. The parts open only for this key and for the owner's and admins' own key

No parameter schema on file.

The account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credentials set and everything deleted. Ordinary work is in the call log (account_list_calls). verify: true also checks the hash chain, which breaks where an entry was changed or removed. Free.

Parameter	Type	Required	Notes
action	string	no	Only actions starting with this, like "key." or "tool.vault_".
since	string	no	—
limit	integer	no	—
verify	boolean	no	—

A department, location or project group of the account, like Support, Finance or the Hamburg shop. Its keys (POST /v1/keys with "team") can only work in its areas, only read when read_only is on, and spend against its budget (monthly_budget_usd per budget_period: a month, a fiscal quarter or year, or a project total): a hard budget refuses the call that would pass it, a soft one only warns. At ale

Parameter	Type	Required	Notes
name	string	yes	—
new_name	string	no	Renames the team; its keys, spend and budget stay with it.
areas	array/null	no	The areas its keys may work in (account tools always); null for every area.
read_only	boolean	no	Its keys only read, and get links that act for whoever opens them as "[redacted]".
monthly_budget_usd	number/null	no	null counts the spend without a cap.
budget	string	no	hard refuses calls past the budget; soft only warns.
alert_percent	integer	no	—
erp_code	string/null	no	—
drafts_only	boolean	no	Every write of its keys waits for a person, and they get links that act for whoever opens them as "[redacted]".
mailboxes	array/null	no	The Microsoft 365 or Google mailboxes its keys may act as; null for every mailbox the connection lists.
budget_period	string	no	What the budget is for: a month, a quarter or a year of the account's fiscal calendar, or a project total until budget_ends_on.
budget_ends_on	string/null	no	The last day of a project budget, like 2026-12-31.
sees_sensitive	boolean	no	false hides suppliers' bank details and HR notes and contracts from its keys; only the owner turns it on.

The account's teams, the company-wide one first: each with its areas, whether it only reads, its budget (hard or soft, and its period) and alert line, this period's spend, its ERP code, whether it is paused, its keys, and its people with who manages it. A person's own assistant works within their teams. Free.

No parameter schema on file.

Stops every key of a team at once, this one too if it is the team's: their calls are refused until the owner starts the team again on their account page. For a bot that misbehaves or a team that spends too fast. Free. Free.

Parameter	Type	Required	Notes
team	string	yes	—

Move a form, a meeting type, a job, an inbox, a phone number, a newsletter, the website chat, a rental, a pipeline, a table or a website to a team. What happens through it is charged to that team from now on (a form's responses, a number's calls, an inbox's tickets), and its rental moves with it. Something a bot makes already belongs to the bot's team. Only a key of the company-wide team without l

Parameter	Type	Required	Notes
kind	string	yes	—
id	string	no	Its id, slug, name, address or number; not needed for the chat.
team	string	yes	—

Make a tool wait for a person: every call of it, those whose argument is over a number (like invoices_create_credit_note when amount is over 500), or those whose argument is one of some values (like connect_call when method is POST, PUT, PATCH or DELETE). A held call answers approval_required with an approval_id and asks the approver; when they approve, call again with the same arguments, once (a

Parameter	Type	Required	Notes
tool	string	yes	—
argument	string	no	An argument of the tool (or total, for purchasing_create_bill).
over	number	no	Calls with argument over this are held.
values	array	no	Calls with argument equal to one of these (any case) are held.
approver_email	string	no	—
approver_channel	string	no	A saved notify channel.
approver_team	string	no	A team (account_list_teams).
approvers	string	no	Who in approver_team approves.
two_people_over	number	no	Calls whose argument is over this need two people; higher than over.

The tools that wait for a person's approval, with their thresholds and approvers. Free.

No parameter schema on file.

Every record this account holds about one person, by their email address or phone number, across every area: CRM, chats, emails, tickets, forms, bookings, calls, applications, invoices, orders, newsletters, HR and the call log, with their chats and CRM history. For a person who asks what the business keeps about them (GDPR Art. 15). Shows each kind with its count and ids; account_export_person giv

Parameter	Type	Required	Notes
email	string	no	The person's email address.
phone	string	no	Their phone number in international format, like +1 503 555 0145.

Everything account_find_person finds about one person in one ZIP in the file store: their records as JSON Lines (credentials left out) and the files those records point to, like a CV. Give the person the download link when they ask for a copy of their data (GDPR Art. 15 and 20), once you know it is them. The ZIP opens only for this key and for the owner's and admins' own keys that neither only rea

Parameter	Type	Required	Notes
email	string	no	The person's email address.
phone	string	no	Their phone number in international format, like +1 503 555 0145.

Erases one person across every area when they ask (GDPR Art. 17), once you know it is them (they wrote from that address, or confirmed it). Their CRM contact, chat visitor, past meetings and calls are anonymised, so deals stay without them, and a meeting they were only a guest at drops them; their chats, CRM history, form and routing form answers, job applications with the CV, newsletter subscript

Parameter	Type	Required	Notes
email	string	no	The person's email address.
phone	string	no	Their phone number in international format, like +1 503 555 0145.
correspondence	boolean	no	Also delete their emails and tickets, when no law requires keeping them.

Where each area's data is stored and processed: the company that runs each place, the country or region, and what it holds. Every area keeps its records in the database and runs on Conecto's servers; some also use a service named here (email, phone, PDFs, search). For the business's records of processing and its transfer assessments (GDPR Art. 30 and 44). Free.

Parameter	Type	Required	Notes
areas	array	no	Areas to show, like ["email", "phone"]; all when left out.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Conecto E-signature or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.0.0 · scanned 3 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 1 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digest139c8e157e15c100ac01c7fae0e977dad4e28e3a3d64f5fac4164fbb980ad68e

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
esign_send	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
esign_get	untrusted-input	untrusted-input: keyword "download"
esign_list	no tags
esign_signing_link	no tags
esign_remind	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
esign_cancel	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
esign_save_template	state-write	state-write: declares readOnlyHint: false
esign_list_templates	no tags
esign_send_template	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
esign_delete_template	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
account_balance	no tags
account_get_call	no tags
account_list_calls	no tags
account_refund_topup	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
account_set_owner_email	state-write	state-write: declares readOnlyHint: false
account_owner_link	no tags
account_dashboard_link	no tags
account_get_limits	no tags
account_request_limit	state-write	state-write: declares readOnlyHint: false
account_events	no tags
account_emit_event	external-sinkstate-write	external-sink: keyword "webhook"; state-write: declares readOnlyHint: false
account_search	no tags
account_get_brand	no tags
account_set_brand	state-write	state-write: declares readOnlyHint: false
account_list_email_templates	no tags
account_set_email_template	state-write	state-write: declares readOnlyHint: false
account_export_all	untrusted-inputstate-write	untrusted-input: keyword "download"; state-write: declares readOnlyHint: false
account_audit_log	no tags
account_save_team	state-write	state-write: declares readOnlyHint: false
account_list_teams	no tags
account_pause_team	state-write	state-write: declares readOnlyHint: false
account_assign_team	state-write	state-write: declares readOnlyHint: false
account_add_approval_rule	state-write	state-write: declares readOnlyHint: false
account_list_approval_rules	no tags
account_find_person	no tags
account_export_person	untrusted-inputstate-write	untrusted-input: keyword "download"; state-write: declares readOnlyHint: false
account_erase_person	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
account_data_locations	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest139c8e157e15c100

Scanned2026-11-03

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Conecto E-signature MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also