{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260918-docusign-mcp-unauthenticated",
  "subject": {
    "type": "tool",
    "id": "docusign"
  },
  "surface": "https://mcp.docusign.com/mcp",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, one IP",
    "body": "an MCP initialize request (jsonrpc 2.0, protocolVersion 2025-06-18, clientInfo public-agents-researcher 1.0), Content-Type application/json, Accept application/json and text/event-stream"
  },
  "observed": {
    "status": 403,
    "headers": {
      "content-type": "text/plain",
      "content-length": "19",
      "ratelimit-limit": "800"
    },
    "decoded": {
      "challenge": "none: the 403 carries no www-authenticate header",
      "body": "RBAC: access denied",
      "protected-resource-metadata": "two well-known URIs, tried in the order the MCP authorization specification (2025-11-25) prescribes when no challenge names one: the path-aware form https://mcp.docusign.com/.well-known/oauth-protected-resource/mcp answers 403 with the same 19-byte plain-text body as the server; the root form https://mcp.docusign.com/.well-known/oauth-protected-resource answers 200, application/json, a complete document: resource https://mcp.docusign.com/mcp, authorization_servers [https://mcp.docusign.com], bearer_methods_supported [header], scopes_supported adm_store_unified_repo_read, aow_manage, signature, resource_documentation the vendor's MCP page. The gate covers the path-aware URI, not the discovery document",
      "authorization-server-metadata": "GET https://mcp.docusign.com/.well-known/oauth-authorization-server answers 200: issuer https://account.docusign.com, authorization and token endpoints on account.docusign.com, grants authorization_code and refresh_token, response type code, PKCE S256, the same three scopes, no registration endpoint. The issuer value is not the URL the resource document names as the authorization server (mcp.docusign.com), which is where this document was read; RFC 8414 section 3.3 has the client check that the two match",
      "tool-catalog": "GET https://mcp.docusign.com/tools with no credentials answers 200: a 47,958-byte JSON-RPC result (jsonrpc 2.0, id 1) listing 22 tools, each with description, title, input schema and annotations (cancelWorkflowInstance, createEnvelope, getAccount, getAgreementDetails, getAllAgreements, getEnvelope, getEnvelopes, getTemplates, getUser, getUserInfo, getUsers, getWorkflowInstance, getWorkflowInstancesList, getWorkflowTriggerRequirements, getWorkflowsList, listRecipients, pauseNewWorkflowInstances, resumeWorkflow, sendReminder, triggerWorkflow, updateEnvelope, updateEnvelopeRecipients); read by hand at 12:12Z, eight minutes after the re-run, and transcribed beside the artifact as tools-catalog-1212Z.txt (the 06:08Z read, tools-catalog-0608Z.txt, listed the same 22 names)",
      "rest": "GET https://account.docusign.com/oauth/userinfo with no Authorization header answers 400 (not 401) with a JSON body whose error is internal_server_error and a reference id, and no www-authenticate",
      "artifact-redactions": "the vendor's per-request trace id (x-docusign-tracetoken on three responses in the probe transcript and one in the catalog read, and the same value as reference_id in the userinfo body) is replaced by a labelled placeholder in the published files after the run, because the publish door reads it as a key; nothing else was changed",
      "revision": "the 06:07Z run of this record (probe-mcp-339ce70f.sh) tried only the path-aware well-known URI and read the 403 as the gate covering discovery; the merge seat measured the root form at 10:05Z and found the document; the script now tries both forms in the specification's order (probe-mcp-b28b75f4.sh) and this record is the 12:04Z re-run. The tool catalog was re-read by hand at 12:12Z and is the same 22 tools"
    }
  },
  "finding": "With no credentials, an MCP initialize POST to mcp.docusign.com/mcp answers 403 with the 19-byte plain-text body \"RBAC: access denied\" and no www-authenticate header: no realm, no metadata URL, no way in, so a client never receives the 401 that starts discovery. The discovery document itself is served: the path-aware well-known URI answers the same 403, and the root well-known URI, the second fallback the current MCP authorization specification requires a client to try, answers 200 with a complete protected-resource document naming mcp.docusign.com as the authorization server and three scopes. That server's metadata names account.docusign.com as its issuer, which does not match the URL it was read from. Besides metadata, the host serves keyless its tool catalog: GET /tools answers 200 with a JSON-RPC result of 22 tools (envelopes, templates, recipients, users, Maestro workflows) each with a description, an input schema and annotations. A keyless GET on the account server's userinfo endpoint answers 400 with an internal_server_error body, not a 401. Same 403 and same public catalog as the 2026-09-13 note in the entry. Nothing here measures what the server does with a credential.",
  "reproducibility": {
    "command": "curl -sSO https://plumb.public-agents.ai/tools/probe-mcp-b28b75f4.sh && echo \"b28b75f43a6fab34a2faa59d67edbeb8b460dbc93e27cf494f3c737cebbc07b8  probe-mcp-b28b75f4.sh\" | sha256sum -c && sh probe-mcp-b28b75f4.sh docusign https://mcp.docusign.com/mcp https://account.docusign.com/oauth/userinfo",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/docusign/2026-09-18/probes-1204Z.txt"
  },
  "at": "2026-09-18T12:04Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-18",
  "updated": "2026-09-18",
  "version": 1
}