Skip to content

Home

Jump to bottom
Yohan Marshall edited this page Aug 29, 2026 · 3 revisions

AgentSign

A signing primitive, not a signing suite. Drop a file or POST it. A human Finishes. An agent can Attest. You get a sealed PDF and an audit trail.

The one rule

Keys authenticate the caller; they never sign for a human. There is no sign API or MCP tool. Humans Finish. Agents Attest.

What it does today

  • Send a document as a PDF, a Word file (.docx, converted server-side), or markdown (rendered to a clean PDF, where {{sig}} tags become fields). Web, REST, and MCP.
  • Fields come from tags in the document, hand placement in the send editor, a fillable PDF's own form fields, or AI detection.
  • Sign: signers get an email link and finish with no account.
  • Attest: named agents attach cryptographic receipts rather than signatures.
  • Verify: anyone can check our seal on a PDF, no auth required.

Send-Pipeline walks through how these fit together.

Packaging

Free, with login optional: 7 days to sign, a 7-day shredder after the keep window, and a quiet cap of about 20 sends per 30 days. Pro at $19/mo: 1-year keep, cap lifted, plus branding, saved templates, team invites, and named agents. Self-hosting entitles the Pro extras forever. Apache-2.0.

Stack

Vercel (Next.js App Router, Node runtime) with Supabase (Postgres, Auth, Storage), Resend for mail, and Stripe Checkout for Pro. UI is shadcn/ui on Base UI with Tailwind.

Working on it

Setup, tests, and env vars live in the README, next to the code they describe, so they stay honest. What is worth knowing before your first PR:

  • Branch from main: claude/<task> for agent work, <name>/<short-desc> for humans. Merge by PR, delete the branch after.
  • No secrets in any file, ever. Local credentials belong in .env.local, which is gitignored.
  • No AI attribution trailers in commits or PR bodies.
  • pnpm uses a hoisted node_modules layout on purpose. Vercel's file tracer needs real paths for Chromium, the pdfjs worker, and the canvas binding. Removing that setting breaks deploys in ways the test suite will not catch.

Design decisions and their history live in docs/: a dated spec and plan per feature, reviewed in the PR that implements it.

Clone this wiki locally