Scope Guard

Created By
mcp-servers2 months ago
Overview

Signova — AI-Powered Legal Document Platform

getsignova.com · ebenova.dev · api.ebenova.dev

Signova generates professional legal documents, contracts, invoices, and compliance reports using AI — built for freelancers, agencies, and small businesses who need legal protection without lawyer fees.


Overview

Signova ships three surfaces from a single codebase:

  • Consumer web app at getsignova.com — pay-per-document generation, promo redemption, buyer capture
  • Developer platform at ebenova.dev + api.ebenova.dev — subscription API with keys, usage tracking, and Stripe billing
  • MCP servers — Model Context Protocol servers that expose the same legal/insights/scope tooling to AI agents (Claude Desktop, Cursor, etc.)

The platform generates 34 document types (NDAs, contracts, offer letters, privacy policies, invoices, change orders, etc.) with jurisdiction-aware drafting for Canada (PIPEDA + Quebec Law 25), the United States (CCPA/CPRA + state privacy laws), the United Kingdom (UK GDPR), the European Union (GDPR), Nigeria (NDPA 2023), South Africa (POPIA), Kenya (DPA 2019), and Ghana (DPA 2012) — all with geo-aware currency detection and locale-specific drafting via Anthropic Claude.


Live URLs

SurfaceURL
Consumer sitehttps://www.getsignova.com
Developer sitehttps://www.ebenova.dev
API basehttps://api.ebenova.dev
OpenAPI spec (file)openapi.yaml

Architecture

Browser / AI Agent
Vercel Edge (vercel.json routing + redirects)
      ├─ Static SPA:  Vite build of src/  →  React 19 + React Router 7
      └─ Serverless:  api/*.js  (Node.js functions)
             ├─ Upstash Redis        (API keys, usage, promo state, rate limits)
             ├─ Anthropic Claude     (document generation, scope analysis)
             ├─ Stripe               (consumer checkout + API subscriptions)
             ├─ Resend               (transactional email, waitlist, receipts)
             ├─ Paystack / OxaPay    (Africa + crypto payments)
             └─ Groq                 (fast previews, insight drafts)

Deployed on Vercel (project signova, owner ebenovasolu-5755s-projects). Cron jobs defined in vercel.json drive /v1/insights/poll (every 15 min) and /api/cron/ots-upgrade (every 2 hours).


Tech Stack

LayerTechnology
FrontendReact 19, Vite 7, React Router 7, Phosphor Icons
BackendVercel Serverless Functions (Node.js, ESM)
ValidationZod 3
DataUpstash Redis (serverless REST)
AIAnthropic Claude (primary), Groq (previews/drafts)
PaymentsStripe (primary), Paystack (NGN), OxaPay (crypto), Flutterwave
EmailResend
AnalyticsVercel Analytics, Vercel Speed Insights
MCP@modelcontextprotocol/sdk
TestingVitest, @testing-library/react, jsdom

Features

Document generation

  • 34 document types: NDA, freelance/service/consulting agreements, employment offer letters, privacy policy, terms of service, invoices, change orders, scope analysis, and more
  • Jurisdiction-aware drafting across Canada, USA (with state-level awareness), UK, EU, Nigeria, South Africa, Kenya, and Ghana
  • Free Groq-powered preview (api/generate-preview.js), premium Claude output on payment verification (api/generate.js, api/v1/documents/generate.js)
  • Conversation-to-document extraction (api/v1/extract/conversation.js)

Promo system

Promo codes bypass payment to unlock one free document. State is stored in Upstash Redis (promo_uses:CODE counters, promo_ratelimit:IP per-IP hourly limiter). IP rate limit: 5 attempts/hour. All codes defined in api/promo-redeem.js.

CodeDescriptionMax usesExpires
SIGNOVA10General discount5002026-12-31
OLUMIDEFounder access (unlimited testing)9,9992027-12-31
AFRICATaryl African Founders Community1,2002026-12-31
KREDOKredo partnership202026-12-31
MEST2026MEST cohort1002026-12-31
CCHUBNIGCcHUB Nigeria2002026-12-31
BAOBAB26Baobab Network cohort802026-12-31
ACCLAFRICAAccelerate Africa cohort502026-12-31
TEF2026Tony Elumelu Foundation1,0002026-12-31
ROSEMARYSingle-use promo102026-12-31

Billing (Stripe)

  • Consumer pay-per-document checkout (api/stripe-checkout.js, api/stripe-verify.js, api/stripe-webhook.js)
  • Subscription plans for the API: Starter $29, Growth $79, Scale $199 (api/v1/billing/checkout.js)
  • Insights add-on plans: Starter $49, Growth $99, Scale $249 — activated commercial feature
  • Stripe Customer Portal (api/v1/billing/portal.js), webhook handler (api/v1/billing/webhook.js)
  • Scope Guard Pro checkout (api/scope-guard-checkout.js) — activated commercial feature

MCP servers

Three first-party MCP servers live under mcp-servers/:

ServerPurpose
mcp-servers/legal-docsDocument drafting tools for AI agents (NDAs, contracts, invoices, change orders)
mcp-servers/insightsBusiness-intelligence / contract analytics tools
mcp-servers/scope-guardScope-creep detection and change-order generation

Each has its own package.json, server.json, and Dockerfile, and publishes independently to npm / the MCP registry / Smithery / Glama.

The site itself also exposes an HTTP MCP endpoint at api/mcp.js.


API authentication

Authenticated endpoints under /v1/* use two distinct credentials:

  1. Bearer API keys (Authorization: Bearer sk_live_...) — end-user keys validated against Upstash Redis via lib/api-auth.js. Used for document generation, extract, scope, vigil, contracts, insights, invoices.
  2. Admin/setup secret (EBENOVA_ADMIN_SECRET) — gates /v1/keys/create so only operators can provision new customer keys. ADMIN_API_TOKEN similarly gates /v1/admin/revenue. BYPASS_ADMIN_SECRET gates api/create-bypass.js. CRON_SECRET / POLL_CRON_SECRET authenticate Vercel cron invocations.

Rate limits and monthly document caps are enforced per key in Redis.

Note: there is no live /docs HTML endpoint today. Consume the OpenAPI spec directly via openapi.yaml.


Local development

Prerequisites

  • Node.js 20+ (ESM)
  • Upstash Redis database (free tier)
  • Anthropic API key
  • Stripe account (only needed to exercise paid flows)
  • Resend API key (optional, for email)

Setup

git clone <repo-url>
cd signova
npm install
cp .env.example .env
# edit .env with your keys

Scripts

npm run dev            # Vite dev server
npm run build          # Production build
npm run preview        # Preview built SPA
npm run lint           # ESLint
npm test               # Vitest
npm run test:coverage  # Vitest with coverage
npm run check:css      # Validate CSS design tokens
npm run keygen         # Generate API/admin secrets

Running the serverless api/ functions locally requires the Vercel CLI:

npm i -g vercel
vercel dev

Environment variables

See .env.example for the full template.

Required (core)

VariablePurpose
ANTHROPIC_API_KEYPrimary AI generation
UPSTASH_REDIS_REST_URLRedis REST URL
UPSTASH_REDIS_REST_TOKENRedis auth token
EBENOVA_ADMIN_SECRETProtects /v1/keys/create
PROMO_SECRETHMAC secret for signed promo tokens

Stripe (required for paid flows)

VariablePurpose
STRIPE_SECRET_KEYStripe API
STRIPE_WEBHOOK_SECRETWebhook signature verification
STRIPE_PRICE_STARTER / _GROWTH / _SCALEMain API plan price IDs
STRIPE_PRICE_INSIGHTS_STARTER / _GROWTH / _SCALEInsights add-on price IDs

Optional (email, alt-payments, misc)

VariablePurpose
RESEND_API_KEYTransactional email
ALERT_EMAILWhere insight alerts are sent (defaults to info@ebenova.net)
GROQ_API_KEYFast preview + draft generation
OXAPAY_MERCHANT_KEYCrypto checkout
PAYSTACK_SECRET_KEY / PAYSTACK_PUBLIC_KEYNGN card checkout
FLUTTERWAVE_SECRET_KEY / FLUTTERWAVE_PUBLIC_KEYAfrican card checkout
NEXT_PUBLIC_APP_URLMagic-link base URL (defaults to https://www.getsignova.com)
CORS_ALLOWED_ORIGINSComma-separated CORS allowlist
LOG_LEVELDEBUG / INFO / WARN / ERROR
NODE_ENVdevelopment / production

Admin, cron, integrations (optional)

VariablePurpose
ADMIN_API_TOKENGates /v1/admin/revenue
ADMIN_SECRETGates api/admin/index-doc.js
BYPASS_ADMIN_SECRETGates api/create-bypass.js
CRON_SECRETAuthenticates /api/cron/ots-upgrade
POLL_CRON_SECRETAuthenticates /v1/insights/poll
FIELDOPS_API_URL / FIELDOPS_INTERNAL_KEYFieldOps bookings bridge
VIGIL_API_URLVigil compliance backend

Deployment

The project is deployed on Vercel:

  • Project: signova
  • Owner: ebenovasolu-5755s-projects
  • Domains routed via vercel.json redirects: apex getsignova.comwww.getsignova.com, apex ebenova.devwww.ebenova.dev
  • Cron jobs configured in vercel.json
vercel          # preview deploy
vercel --prod   # production deploy

Configure environment variables in Vercel → Project Settings → Environment Variables (mirror the list above).


Testing

Current status — be honest about what ships vs. what is planned:

AreaStatus
lib/sanitize.jsDone
lib/parse-body.jsDone
lib/cors-middleware.jsDone
API endpoint integration testsPlanned
React component testsPlanned

Run with npm test (Vitest). npm run test:coverage emits a v8 coverage report.


Project structure

signova/
├── api/                   # Vercel serverless functions
│   ├── v1/                # Versioned API (auth, billing, documents, insights,
│   │                      #   vigil, scope, contracts, extract, invoices, keys, admin)
│   ├── admin/             # Admin-only operator endpoints
│   ├── cron/              # Scheduled tasks (ots-upgrade)
│   ├── generate.js        # Premium document generation (Claude)
│   ├── generate-preview.js# Free preview generation (Groq)
│   ├── promo-redeem.js    # Promo code redemption (10 codes)
│   ├── stripe-*.js        # Consumer Stripe flow
│   ├── paystack-*.js      # Paystack flow
│   ├── oxapay-*.js        # OxaPay crypto flow
│   ├── mcp.js             # HTTP MCP endpoint
│   └── ...
├── lib/                   # Shared server libraries (auth, CORS, Redis, validators,
│                          #   sanitize, parse-body, logger, analytics)
├── src/                   # React SPA (pages, components, lib, styles)
├── mcp-servers/
│   ├── legal-docs/        # Legal document MCP server (publishable)
│   ├── insights/          # Insights MCP server (publishable)
│   └── scope-guard/       # Scope-guard MCP server
├── tests/                 # Vitest test suite
├── scripts/               # Dev utilities (keygen, CSS token check, etc.)
├── openapi.yaml           # OpenAPI 3.1.0 specification
└── vercel.json            # Vercel routing, redirects, cron

  • ebenova-legal-docs-mcp — published distribution of the legal-docs MCP server (npm, MCP Registry, Smithery, Glama, MCPize)

License

© 2026 Ebenova Solutions. All rights reserved. Commercial product — unauthorized copying, distribution, or modification is prohibited. See LICENSE.


Support


Documents generated by Signova are for informational purposes only and do not constitute legal advice. Always consult a qualified attorney before relying on AI-generated legal documents.

Project Info
Created At
2 months ago
Updated At
a month ago
Author Name
mcp-servers
Star
-
Language
-
License
-
Category
Tags

Recommend Servers

View All
Bring your real authenticated browser session to AI coding agents. Local-first MCP server + Chrome MV3 extension. No cloud. No telemetry.
@Cubenest

peek records the user's actual logged-in browser (DOM via rrweb, console events, network metadata, optional response bodies via opt-in Deep capture) through a Chrome MV3 extension. The extension ships events through a native-messaging stdio bridge to a local MCP server (peek-mcp), which persists them to a SQLite database at ~/.peek/sessions.db. AI coding agents (Claude Code, Cursor, Cline, Windsurf) read sessions from the database via 10 MCP tools: Tool What it does list_recent_sessions List recently recorded sessions (id, origin, ts, event count). get_session_summary LLM-readable narrative summary of a session. get_session_console_errors Console errors recorded in a session. get_session_network_errors Failed/notable network requests in a session. get_user_action_before_error Last N user actions before a console error. generate_playwright_repro Generate a runnable Playwright test from a session. get_dom_snapshot Reconstruct the DOM at a given timestamp. query_dom_history Timeline of attribute/text changes for a selector. request_authorization Side-panel consent for write actions (Level 3). execute_action Dispatch a UI action (gated by permission level + destructive blocklist). Why local-first matters Every other "browser session for AI" tool ships to a vendor cloud. peek's SQLite + extension live on the user's machine — no remote endpoints, no telemetry. The privacy policy (docs/peek/PRIVACY_POLICY.md) is the source of truth. Install # 1. Add the MCP server to Claude Code claude mcp add peek -- npx -y @peekdev/mcp # 2. Install the Chrome extension from the Chrome Web Store # (link added once the CWS listing is approved)

2 days ago
Voyei

4 hours ago