How to audit a folder of signed documents with an AI agent Leave feedback

Compliance questions are rarely about one file. “Are all of last quarter’s contracts signed?”, “whose certificate expired?”, “which ones were re-saved after signing?” — one prompt, a folder, one table.

Note

The commands and config snippets on this page are for the .NET build of the server — the only platform available today. Installation and client setup: MCP server for .NET. Other platforms will expose the same tools with their own launch command; everything else on this page applies unchanged.

Point GROUPDOCS_MCP_STORAGE_PATH at the folder (configuration). Files are resolved by name, so the agent passes contract-042.pdf, not a path from your machine.

For every PDF in my documents folder, check whether it is digitally signed and still valid. Give me a table: file, signer, signed date, status.

The agent calls verify and search_digital_signatures per file and assembles the answer. Two calls per document, one table at the end.

• Unsigned files — the gap the audit exists to find.
• Invalid signatures — almost always “something changed after signing”: a stamp added later, a re-save, a page appended. Worth knowing which.
• Expired certificates — the signature was valid when made; whether it still counts is your policy, and the validity window is in the data.

• Use verify for the yes/no pass, and only run the detail search on the files that need it.
• Skip search_image_signatures in bulk — it returns base64 images for every hit and inflates the run for nothing.
• Leave returnImage off on code searches.
• Under metered licensing each call is billed usage, so a targeted sweep is cheaper as well as faster.

The two-page evaluation cap makes bulk audits wrong, not just limited. A signature on page 4 of an unlicensed run does not appear, so a clean-looking report can be false. Check get_license_status first, every time.

This is a report, not an attestation. The agent summarizes what the engine found; it is not a notary. For formal evidence, keep the per-file certificate details — signer, issuer, serial, timestamp — rather than the agent’s prose summary.

Sign the three unsigned ones with our standard QR reference and list what you did.

Same session, same folder, no uploads — see Sign documents with AI agents.