# create_signing_envelope

Create a FreeSign envelope from a PDF SHA-256 hash. Do not send PDF bytes. The created envelope is NOT yet session-bound — the browser that opens the returned signing_url generates an ECDSA P-256 keypair locally and POSTs the public JWK to /api/envelopes/{id}/session-bind before any protected request will succeed. AI agents calling this tool just hand the signing_url to a human, who continues in a browser.

Agent View of the PolicyLayer registry record for `create_signing_envelope`. HTML page: https://policylayer.com/tools/com-free-sign-signing/create-signing-envelope

## Facts

- Tool: `create_signing_envelope`
- Server: FreeSign — Free e-signature (`https://free-sign.com/mcp`) — https://policylayer.com/tools/com-free-sign-signing.md
- Homepage: https://github.com/https://free-sign.com/mcp
- Risk category: Write (Medium risk)
- Registry record: grade C, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 1 (1 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `document_sha256` | string | yes | SHA-256 of the original PDF bytes, computed locally by the user or agent. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_signing_envelope",
    "arguments": {
      "document_sha256": "<document_sha256>"
    }
  }
}
```

## Why create_signing_envelope is rated Medium

This tool creates a new, persistent signing envelope bound to a document hash, which modifies server state irreversibly by registering a signing session. Although the envelope itself is not session-bound until a human uses the returned URL, the creation of the envelope is a Write operation.

From the tool's own definition: "'Create a FreeSign envelope' — the tool creates a new signing envelope object. The description confirms this is a creation operation ('create_signing_envelope') that produces a signing_url for downstream use."

## Use case

AI agents use create_signing_envelope to create or update resources in FreeSign — Free e-signature, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your FreeSign — Free e-signature environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches FreeSign — Free e-signature:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_signing_envelope": {
      "limits": [
        {
          "counter": "create_signing_envelope_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on FreeSign — Free e-signature (4)

- `get_ots_proof` — Read — https://policylayer.com/tools/com-free-sign-signing/get-ots-proof.md
- `get_receipt` — Read — https://policylayer.com/tools/com-free-sign-signing/get-receipt.md
- `verify_audit_chain` — Read — https://policylayer.com/tools/com-free-sign-signing/verify-audit-chain.md
- `verify_document_hash` — Read — https://policylayer.com/tools/com-free-sign-signing/verify-document-hash.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-free-sign-signing · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-free-sign-signing