E-signature for AI agents
An AI agent should be able to prepare a contract and never be able to sign one. docuinked gives agents the first power and withholds the second, in the server, where a prompt can't change it.
The problem
Agents read text they didn't write. A PDF from a counterparty can hold white-on-white instructions. An email can say "send this to the address below". A signing tool sits at the worst spot for this. It holds private contracts, it reads outside text, and it can reach anyone by email.
Most tools answer with advice: ask the user first. That advice lives in a prompt, and the attack lives in the same place. We think that is the wrong layer.
What docuinked does
- Agents can't sign. No sign call exists. Live signing links never go to an agent.
- Agents can't send alone. A live send over MCP creates an approval. A person opens it and sees the draft as the server holds it.
- Approval binds to a hash. If the draft changes, the approval is void.
- The record keeps roles apart. The log shows which key prepared, who approved, and who signed.
A worked flow
A sales agent hears "they're ready to sign". It finds the template with list_templates, fills it with create_from_template, and calls send_document. It gets an approval_url and tells you. You read the draft and approve it. The customer gets an email. The agent later calls get_evidence and files the record. The agent did all the work, and it held none of the authority.
Honest limits
An approval is only as good as the person reading it. And if an agent has full control of a signer's mailbox, it can open that signer's link, so add an access_code to documents that matter. Read more in signing from an AI agent.
Common questions
Why not just tell the agent to ask first?
Because that instruction sits next to untrusted text and can lose to it. A server rule doesn't read prompts. It checks the key and the hash.
Do I have to approve every document forever?
Agents over MCP do. For fixed, trusted flows, your own server can use a "Sends directly" key over REST. That is a choice you make for code you control, not one an agent can make.
Which agents work with docuinked?
Any agent that speaks MCP or can make HTTP calls. See the MCP install lines for Claude, Cursor, Codex and others.
Related
Try it in test mode
Free during the beta. Test keys send no email, so you can build the whole flow first.