Test it live

Run this flow in ZapSign Builders — the interactive REST API playground. Open in Builders →

What it is

The ZapSign api-mcp project is a Model Context Protocol (MCP) server — the open standard that connects LLMs to external systems. It translates the ZapSign REST API into typed tools that any MCP client (Claude, Cursor, Codex, Gemini CLI, ChatGPT connectors, custom agents) can discover and call safely.

In practice: instead of writing integration code yourself, your agent receives tools such as create_document_from_template and decides when to use them from natural-language instructions.

Installation

Via npm (for npx in MCP clients):

terminalbash
npm install -g mcp-server-zapsign
# or without a global install:
npx -y mcp-server-zapsign

From source (for SSE, production, or development):

terminalbash
git clone https://github.com/ZapSign/api-mcp.git
cd api-mcp
npm install
cp .env.example .env   # set ZAPSIGN_API_KEY

Configuration (.env)

.envenv
# Required
ZAPSIGN_API_KEY=your_api_token

# Sensible defaults
ZAPSIGN_BASE_URL=https://sandbox.zapsign.com.br/api/v1
ZAPSIGN_API_VERSION=v1
PORT=3001
HOST=localhost
LOG_LEVEL=info
ENABLE_RATE_LIMITING=true
MAX_REQUESTS_PER_MINUTE=100

For production, point ZAPSIGN_BASE_URL to https://api.zapsign.com.br/api/v1 and use a production token from app.zapsign.com.br.

Modes: remote URL vs stdio

  • Remote (recommended for most users): clients connect to https://mcp.zapsign.com.br/mcp (OAuth-protected). No local Node process.
  • stdio / npx: the client spawns npx -y mcp-server-zapsign with ZAPSIGN_API_KEY in env. Ideal for offline/dev workflows.

What tools are exposed

The server maps the main ZapSign API surface: create/list/update documents, add signers, use templates, manage webhooks, background checks, and timestamps. Exact tool names appear in your client’s tool picker after connecting.

Security basics

  • Never commit ZAPSIGN_API_KEY or paste it into public prompts.
  • Prefer sandbox tokens while prototyping.
  • Enable rate limiting in production and restrict webhook endpoints with a shared secret header.

Next steps