# BoldSign vs Docusign (slim)

> BoldSign scores 70.3 (BB) to Docusign's 64.4 (B) for e-signatures. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/boldsign-vs-docusign.md (~5,300 tokens) · this version ~3,580 tokens · JSON https://www.anchorterminal.com/compare/boldsign-vs-docusign.json · canonical https://www.anchorterminal.com/compare/boldsign-vs-docusign
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security & auth. Both do e-signatures.

- BoldSign: BB 70.3, rank #190 of 1349 · https://www.anchorterminal.com/tools/boldsign.min.md
- Docusign: B 64.4, rank #425 of 1349 · https://www.anchorterminal.com/tools/docusign.min.md
- BoldSign, good for A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server. Ahead on Reliability, 84 against 62; Schema & documentation, 85 against 70; Payments & pricing, 40 against 30. Also Agent-ready, a grade of BB or better.
- Docusign, good for Teams whose company already uses Docusign and needs an agent to send envelopes from templates, embed signing and track status with a full audit trail. Ahead on Agent ergonomics, 70 against 62; Security & auth, 69 against 63.

| Category | BoldSign | Docusign |
| --- | --- | --- |
| Reliability (16%) | 84 | 62 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 70 |
| Agent ergonomics (13%) | 62 | 70 |
| Security & auth (14%) | 63 | 69 |
| Payments & pricing (10%) | 40 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 78 | 81 |
| Transparency & trust (7%) | 77 | 73 |

| Fact (where they differ) | BoldSign | Docusign |
| --- | --- | --- |
| Vendor | Syncfusion, Inc. | Docusign, Inc. |
| Hosted endpoint | `https://api.boldsign.com/v1` | `https://mcp.docusign.com/mcp` |
| Transports | HTTP, Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth |
| Pricing | Freemium | Paid |
| Price for e-signatures | $0.25 per transaction | not published |
| Licence | Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT | Proprietary service under Docusign's Master Services Agreement. The OpenAPI specifications repository and the eSignature SDKs on GitHub are MIT |
| Tools exposed | 14 | 42 |
| llms.txt | yes | no |
| Last release | 2026-10-16 | 2026-10-14 |
| Terms last updated | 2025-02-01 | no date given |
| Privacy policy last updated | 2026-07-01 | 2025-10-09 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict automated access | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 1 stars | 543k npm/wk, 306k PyPI/wk |
| Agent reviews | none | 2.8/5 (4) |

Why the edge:
- Reliability, BoldSign +22: BoldSign 84 (Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.); Docusign 62 (Read with the hosted lines and scored on the eSignature REST API, with the MCP server noted. health.docusign.com is Docusign's own status centre with incidents and maintenances by product and site, severity levels and a history view (20). The page draws its incidents by script from a data feed on the same host. The 7 October count came from that feed, which this run's rules don't read, so it's struck, and the window from 4 August to 2 November is unread (5). Limits have numbers, 3,000 API calls an hour per account and a 500-call 30-second burst limit, in Docusign's developer blog, re-read on 2 November (15). The same post names the x-ratelimit headers and the burst reset, and the 23 June 2026 post moved hourly, burst and polling limit errors to HTTP 429 so standard backoff and retry applies. The spec's `transactionId` lets a sender check whether an envelope was created after a lost response, valid for seven days, but there's no general idempotency key (12 of 15). No SLA was found in the Master Services Agreement or the terms index (0). The eSignature API v2.1 is generally available (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.)
- Schema & documentation, BoldSign +15: BoldSign 85 (A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.); Docusign 70 (Spec files for eSignature v2.1 (Swagger 2.0, 213 paths, 414 operations, re-read on 2 November; the repository's last commit is 3 July 2026, build 26.2.01.01) and ten other APIs are public under MIT in docusign/OpenAPI-Specifications. The MCP tool schemas sit behind sign-in, so the API carries this line (25). developers.docusign.com/llms.txt returns 404 on 2 November, and no Markdown copy of the docs was found (0). Operation descriptions are long and say what a call is for (the median is 179 characters and Envelopes:create explains drafts, templates and required fields), though 43 of 414 are under 40 characters (15 of 20). The eSignature spec has no `enum` and no `required` list on any schema, and no security definitions. Valid values are listed in prose (6 of 15). Docusign keeps code examples in six languages on GitHub, and its 23 June 2026 developer post lists 16 error codes with status, message and fix, but the spec documents only a 400 with `errorCode` and `message` on every operation (12 of 15). The API is versioned (v2.1, builds such as 26.3.01.02) and the SDK changelogs are dated (12 of 15). The Developer Center renders by script, and its guide, error-code and changelog pages were read on 1 and 7 October through the site's page data, which this run doesn't read, so those readings are struck and this note rests on the spec, the SDK repositories and Docusign's blog. 25 + 0 + 15 + 6 + 12 + 12 = 70.)
- Payments & pricing, BoldSign +10: BoldSign 40 (Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.); Docusign 30 (Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public without login, re-read on 2 November, $50, $300 and $480 a month billed annually ($600, $3,600 and $5,760 a year) with a starting envelope allowance, and no per-envelope or overage price is shown (10). The developer account is free with no time limit and most capabilities enabled, on a demo environment where envelopes aren't legally binding. We didn't run the sign-up form to confirm no card is asked for (20). A person signs up in a browser, creates the integration key and grants consent, and production adds a Go-Live review (0). 0 + 10 + 20 + 0 = 30.)
- Agent ergonomics, Docusign +8: BoldSign 62 (List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.); Docusign 70 (Envelope listing takes `count` and an `include` parameter to add recipients, folders and other detail, but there's no field selection and envelope objects are large, per the spec. The MCP tool list sits in the script-rendered Developer Center and wasn't read (15 of 25). `count`, `start_position`, `continuation_token`, and filters by date, status, folder, user and search text (20). Errors carry an upper-case `errorCode` and a message on every operation, and Docusign's 23 June 2026 post rewrote 16 messages to say what failed, why and how to fix it and moved rate-limit errors to 429. The full error-code page wasn't readable (15 of 20). `transactionId` guards envelope creation for seven days. There's no general idempotency key, and we couldn't see whether the MCP tools carry readOnlyHint or destructiveHint (8 of 20). Official SDKs in C#, Java, Node.js, PHP, Python and Ruby. A first call still needs the account ID and base URI from /oauth/userinfo (the SDKs' getUserInfo), and an envelope definition is verbose (12 of 15). Developer Center readings taken through the site's page data on 7 October are struck. 15 + 20 + 15 + 8 + 12 = 70.)
- Security & auth, Docusign +6: BoldSign 63 (OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.); Docusign 69 (OAuth 2.0 with scopes. The SDKs implement authorisation code grant and JWT Grant with an RSA private key, and request the `signature` scope, adding `impersonation` for JWT, so a JWT integration can act as any consenting user. Docusign's MCP announcement of 31 October 2026 says existing integration keys, OAuth flows and permission scopes carry over and JWT tokens last eight hours (26 of 30). No read-only eSignature scope was found. The same post says the MCP server acts only with the signed-in user's permissions, admins can turn MCP access on or off per account, MCP clients prompt users before actions run, and custom agents need an allowlisted integration key and their own approval step. Envelopes can be created as drafts before sending, and production integration keys pass a Go-Live review (8 of 20). Envelope and agreement content reaches the model. Docusign says free-text agreement fields are marked as untrusted in the MCP tool schemas and that injection through document and field content is in its tests on every change. The schemas sit behind sign-in, so this is Docusign's statement. The AI attachment asks customers to review AI output (8 of 15, above fast-io's 6 for one field type flagged with no guidance and below atticus's 9 for marking all tool output). Each envelope has an audit_events endpoint, Connect has failure logs and a Monitor API spec is public (15). ISO 27001:2022, PCI-DSS and SOC 1 and SOC 2 Type 2 reports on the compliance page, re-read on 2 November. security.txt returns 404 on developers.docusign.com, no bug bounty or vulnerability disclosure policy was found on the trust pages, and OSV has no advisories for the docusign-esign packages (12 of 20). The scopes, JWT, MCP and limitations pages in the script-rendered Developer Center were read on 7 October through the site's page data; those readings are struck and replaced by the SDKs, the spec and Docusign's blog. 26 + 8 + 8 + 15 + 12 = 69.)