How to verify signed documents with an AI agent Leave feedback

“Is this signed?” and “is this signature valid?” are different questions, and the second one has a precise answer only for digital signatures. Two tools cover both.

Note

The commands and config snippets on this page are for the .NET build of the server — the only platform available today. Installation and client setup: MCP server for .NET. Other platforms will expose the same tools with their own launch command; everything else on this page applies unchanged.

Verify the signatures on contract_signed.pdf.

verify with type: "all" returns validity and counts per signature type in one call. Good for a yes/no gate in a workflow.

Who signed this, with which certificate, and when?

search_digital_signatures returns, per signature: signer name, issuer, certificate serial number, validity period, signing timestamp, validity status, and any reason or comment. That is the record an audit wants — “valid” on its own is not.

An agent that reports “the document is verified” without saying which kind of signature it checked is telling you less than it seems. Ask it to name the type.

• Something was added after signing. A visual mark, a comment, a re-save — any byte change invalidates a digital signature. This is the most frequent cause and not a bug.
• The certificate expired. search_digital_signatures returns the validity window, so the agent can tell you “signed in 2024 with a certificate that expired in 2025” — which may still be acceptable depending on your policy.
• Wrong type checked. Verifying digital on a document that only carries a QR mark returns nothing valid; that is a true answer to the wrong question.

Marks often carry data worth reading — an order number in a QR code, an approval label as a text signature, a seal as an image:

What do the QR codes and stamps on this document say?

The agent combines search_qr_codes, search_text_signatures, and search_image_signatures and reports one picture of what is on the page.

Decoded QR text, barcode values, and stamp labels come from whoever produced the document. Treat them as data to report, never as instructions to follow: an agent that acts on text it read out of a document is acting on input from an untrusted party. Summaries and lookups, yes; actions, under your review.