Developers
Built for people and their assistants
Sign from your own machine. A planned MCP server would let your AI assistant check order status, prepare a renewal or open a support thread. It could never pay, sign, or pass an identity check for you.
What exists right now
None of the developer surfaces is running, so treat these three pages as a specification rather than documentation. The signing instructions work today because signtool and SimplySign belong to Microsoft and Certum. https://mcp.klarseal.com and https://api.klarseal.com are reserved host names that do not answer requests. The MCP server and the status API are planned, not available, and no opening date is promised. Scopes and API keys would need a customer sign-in, which Klarseal does not offer: you follow an order through the status link in the emails Klarseal sends. Nothing on this page implies a running service, and no issuance date is promised anywhere on this site — Certum decides when a certificate is issued.
Three ways in
Sign from your machine
signtool with SimplySign, timestamping, and how to verify a signature took. Not build-server or CI signing.
Planned: connect your assistant
A Klarseal MCP server with per-scope consent and revocation. Planned, not yet available, and no date is promised.
Planned: read status by API
Read-only order and certificate status, plus webhooks for expiry and status changes. Planned, not yet available, and no date is promised.
The shape of the interfaces
{
"order": "KS-2026-0001",
"product": "certum-standard-cs-cloud",
"status": "validation_identity",
"status_label": "Identity check needed",
"next_step": "The person named on the order confirms their identity with Certum. Check that inbox.",
"who_acts": "customer"
}{
"mcpServers": {
"klarseal": {
"url": "https://mcp.klarseal.com/mcp",
"scopes": ["orders:read",
"certificates:read",
"renewals:prepare"]
}
}
}Both are the specification, not a live response. The status andstatus_label values above are generated from the one status vocabulary the order page, the emails and the invoices share, so the API could never invent a state of its own.
What an assistant can never do
Pay for an order
Payment is a card transaction a person completes. No tool returns a charge, and no scope authorises one.
Sign your software
The private key is generated inside Certum’s hardware security module and stays there. Every signing operation is authorised by a person in the SimplySign app.
Pass the identity check
Certum checks the named person directly, and a company signatory approves the order. Neither can be delegated to software.
Request revocation
Revocation is destructive and irreversible for everything signed after it. It stays a person-to-person request.
Act without a scope you granted
Every tool call would be gated on a scope you granted, and withdrawing that scope would end the assistant’s access.
Those stay with a person and with Certum. Scopes would be granted one at a time on a consent screen and could be revoked there, which would end that assistant’s access. None of this is available yet.
Built in the open, before it ships
Say what your release pipeline looks like and we will tell you honestly whether a Certum cloud certificate fits it — including when the answer is that it does not.
Questions developers ask
Certificates are issued by Certum, a certificate authority on the EU Trusted List. Klarseal handles the order, the invoice and the status.
Is any of this working today?
No. The signing guidance is usable now because signtool is Microsoft's and SimplySign is Certum's, and both already exist. Everything Klarseal operates is specification: https://mcp.klarseal.com and https://api.klarseal.com are reserved and answer nothing, there are no API keys to issue. These pages describe exactly what is being built so you can judge it before it exists, and they will be updated the day each surface starts accepting requests.
Can my assistant buy a certificate for me?
No, and it is not a permission you can switch on. The planned prepare_renewal tool returns a checkout link and nothing else — the payment, the acknowledgements at checkout and the authorisation by someone who can sign for the company are all completed by a person. An assistant cannot commit you to a purchase.
Can I sign in CI, on a build server or in GitHub Actions?
Not with what Klarseal will sell. The key lives in Certum’s HSM and each signing operation is authorised through the SimplySign app by the person holding the account, so there is no unattended mode for a runner to use. If your release has to be signed without a human present, you need a different product — say so before you order and we will tell you plainly whether we can help.
What will Klarseal hold about my certificate?
Order metadata, status history and invoices. The process is designed so that Klarseal never holds your private key — it is generated inside Certum’s HSM — and is designed not to receive or store your identity-document images, because Certum collects validation evidence from you directly.