{
  "markdown": "# PolicyForge MCP Server\n\nGenerate legal policies — privacy policies, terms of service, cookie policies,\nrefund policies, EULAs, disclaimers, and HIPAA Business Associate Agreements —\ndirectly from your AI coding tools (Claude Code, Cursor, Windsurf, Claude\nDesktop) via the [Model Context Protocol](https://modelcontextprotocol.io).\n\nAsk your agent *\"generate a GDPR + CCPA privacy policy for this app\"* and it\nfills the details from your codebase, calls PolicyForge, and drops the policy\nstraight into your project.\n\n**Try it free:** compliance audits (`audit_compliance`), drift checks\n(`check_policy_freshness`), and the scan rubric (`get_disclosure_checklist`)\nare unlimited and never touch your quota — start with\n*\"audit our compliance — does the privacy policy cover everything this code\nactually does?\"*. And the first time your account connects through MCP it gets\n**3 bonus policy generations** on top of the free 2/month — enough to generate\nprivacy, terms, and cookie policies for a new project in one conversation.\n\n## Connect\n\nPick the row that matches your client. If you're unsure, start with **A**.\n\n| | How you sign in | Best for |\n| --- | --- | --- |\n| **A. Remote + OAuth** | Browser sign-in, no key to copy | Clients that support OAuth (Claude, ChatGPT) |\n| **B. Remote + API key** | `Authorization` header | Any client that can send a header |\n| **C. Local (npx)** | `POLICYFORGE_API_KEY` env var | Running the server as a local process |\n\nAll three expose the same tools. A and B need nothing installed.\n\n### A. Remote with OAuth (easiest)\n\nNo key to copy, no config file to edit. You'll need a PolicyForge account\nfirst — <https://policyforge.co>, free, no card.\n\n**1. Add the server.** The `-s user` makes it available in every project rather\nthan only the directory you ran this in:\n\n```bash\nclaude mcp add -s user --transport http policyforge https://policyforge.co/api/mcp\n```\n\nNote there is no `--header`. Omitting it is what makes the client use OAuth.\n\n**2. Restart your client.** MCP config is read at startup, so a session that\nwas already running won't see the new server.\n\n**3. Authenticate.** Run `/mcp`, select `policyforge`, and press Enter:\n\n```\npolicyforge · △ needs authentication\n```\n\nYour browser opens, you sign in and approve, and the client stores the token\nitself. You should land back at `/mcp` showing `✔ connected · 15 tools`.\n\nTo confirm from the other side, a key named `MCP · <your client>` appears at\n<https://policyforge.co/api-dashboard> — that's the grant, and deleting it\nrevokes access.\n\nOther clients differ in step 3: some prompt on first tool use rather than\noffering an explicit authenticate action.\n\n### B. Remote with an API key\n\nFor clients that don't do OAuth yet. Create a key at\n<https://policyforge.co/api-dashboard>, then:\n\n```bash\nclaude mcp add --transport http policyforge https://policyforge.co/api/mcp \\\n  --header \"Authorization: Bearer pf_your_key_here\"\n```\n\nFor clients with URL-based MCP config (Cursor, Windsurf, and others):\n\n```json\n{\n  \"mcpServers\": {\n    \"policyforge\": {\n      \"url\": \"https://policyforge.co/api/mcp\",\n      \"headers\": { \"Authorization\": \"Bearer pf_your_key_here\" }\n    }\n  }\n}\n```\n\n### C. Local (npx)\n\nPrefer a local process? The server runs via `npx` — nothing to install\nglobally. Uses an API key from the environment, which is what the MCP spec\nrecommends for stdio transports.\n\n#### Claude Code\n\n```bash\nclaude mcp add policyforge \\\n  --env POLICYFORGE_API_KEY=your_key_here \\\n  -- npx -y @policyforge/mcp@latest\n```\n\n#### Cursor / Claude Desktop / Windsurf\n\nAdd to your MCP config (`.cursor/mcp.json`, `claude_desktop_config.json`, etc.):\n\n```json\n{\n  \"mcpServers\": {\n    \"policyforge\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@policyforge/mcp@latest\"],\n      \"env\": {\n        \"POLICYFORGE_API_KEY\": \"your_key_here\"\n      }\n    }\n  }\n}\n```\n\n> On Windows, some clients need the command wrapped: set `\"command\": \"cmd\"` and\n> `\"args\": [\"/c\", \"npx\", \"-y\", \"@policyforge/mcp@latest\"]`.\n\nSee <https://policyforge.co/mcp> for one-click installs (Cursor/VS Code) and\nper-client instructions — with your API key pre-filled when signed in.\n\n## Troubleshooting\n\n- **401** — if you connected with OAuth, the authorization was revoked or\n  expired: reconnect and approve again. If you used an API key, it was deleted,\n  disabled, or mistyped (keys start with `pf_`) — rotate or create one at\n  <https://policyforge.co/api-dashboard> and restart the client.\n- **402** — generation quota exhausted. Free tier: 2 generations per calendar\n  month, plus a one-time bonus of 3 extra generations on first MCP connect.\n  Only `generate_policy`/`regenerate_policy` consume quota — audits and drift\n  checks are free; ask your agent to run `get_usage` to see what's left.\n- **429** — request rate limit (free tier: 10/minute, 100/day); the response\n  includes `retry_after`.\n- **Server not listed in `/mcp`** — either the session started before you added\n  it (restart the client; config is read at startup), or it was added to a\n  different project scope. `claude mcp add -s user …` makes it available\n  everywhere.\n- **Tools missing** — restart the client after config changes; on Windows use\n  the `cmd` wrapper above.\n- **\"The redirect URI is not registered for this application\"** — the client is\n  using a callback URL we haven't seen. Loopback callbacks work on any port\n  (per RFC 8252), so this should be rare; report the exact URI and it can be\n  supported.\n\nMore detail: <https://policyforge.co/mcp#troubleshooting>\n\n## Tools\n\n| Tool | What it does |\n| --- | --- |\n| `generate_policy` | Generate a policy and return its Markdown content + hosted URL. Consumes one policy from your quota. |\n| `generate_baa` | Generate a HIPAA Business Associate Agreement between a covered entity and a vendor handling PHI. Built from the clauses required by 45 CFR 164.504(e) and validated clause by clause. Pro plan; never publicly hosted. Consumes one policy from your quota. |\n| `regenerate_policy` | Re-run the AI engine with changed business context — same ID and hosted URL, previous content saved as a version. |\n| `update_policy` | Hand-edit a policy in place — same ID and hosted URL, so published links keep working. |\n| `audit_compliance` | Gap analysis: compare what the code does (your scanned manifest) with what a policy discloses. |\n| `check_policy_freshness` | Drift detection: diff the current codebase scan against the manifest stored at generation time. |\n| `list_policy_versions` | Version history — a snapshot is saved before every update, regeneration, or restore. |\n| `restore_policy_version` | Roll a policy back to any previous version (itself reversible). |\n| `list_policies` | List policies on your account (filter by type/status, paginate). |\n| `get_policy` | Fetch a single policy by ID, including full content. |\n| `delete_policy` | Permanently delete a policy (its hosted URL stops working). |\n| `get_usage` | Check your tier and remaining generation quota before generating. |\n| `get_disclosure_checklist` | The codebase-scan rubric: which SDKs/patterns require disclosure and how findings map to `generate_policy` fields. |\n| `get_integration_guide` | Copy-paste embed/link instructions for Next.js, React, plain HTML, or WordPress. |\n| `list_policy_types` | List supported policy types, business types, and jurisdictions. |\n\n### The codebase-aware workflow\n\nYour agent can read your project — so policies come from what the code *actually\ndoes*, not what you remember it doing:\n\n1. `get_disclosure_checklist` → agent scans dependencies, script tags, cookie\n   writes, and outbound hosts against the rubric, and builds a **stack\n   manifest** of what it found\n2. `generate_policy` with the detected context + `stack_manifest` (stored\n   server-side for drift detection)\n3. `get_integration_guide` → agent wires the hosted policy into your footer\n4. Later, after the stack changes: `check_policy_freshness` reports the drift,\n   `audit_compliance` shows the concrete gaps, and `regenerate_policy` fixes\n   them — same hosted URL, no broken links, previous version restorable\n\n### `generate_policy` inputs\n\n**Required:** `type`, `business_type`, `jurisdiction`, `company_name`, `contact_email`\n\n- `type` — `privacy_policy` · `terms_of_service` · `cookie_policy` · `refund_policy` · `eula` · `disclaimer`\n- `business_type` — `e-commerce` · `saas` · `healthcare` · `education` · `financial` · `fintech` · `real-estate` · `non-profit` · `consulting` · `media` · `mobile_app` · `other`\n- `jurisdiction` — one or more of `gdpr` `ccpa` `pipeda` `lgpd` `us` `eu` `ca` `uk` `au` `br` `global` (comma-separate to combine, e.g. `gdpr,ccpa`)\n\n**Optional context** (improves output): `website_url`, `service_description`,\n`data_collection[]`, `third_party_integrations[]`, `data_retention`,\n`user_accounts`, `payments`, `marketing`, `analytics`, `cookies`,\n`children_data`, `sells_data`, `target_audience[]`, `security_measures[]`,\n`governing_law`, `physical_address`, `dpo_email`, `consent_tracking`,\n`hosting_enabled`.\n\n### `generate_baa` inputs\n\nA Business Associate Agreement is a contract between two named parties, not a\npublished policy, so it takes its own tool and its own fields. **Pro plan.**\n\n**Required:** `acknowledge_contract` (must be `true`), `baa_direction`,\n`company_name`, `contact_email`, both parties' legal names and addresses,\n`baa_effective_date` (`YYYY-MM-DD`), `baa_services_description`,\n`baa_phi_types[]`, `baa_permitted_uses[]`, `baa_governing_law_state`.\n\n- `baa_direction` — `covered_entity_to_vendor` (you are the practice issuing\n  the agreement) or `business_associate_to_client` (you are the vendor\n  offering it to a healthcare client)\n- `baa_phi_types[]` — categories of PHI involved. Including\n  `\"Substance use treatment records (42 CFR Part 2)\"` adds a Part 2 addendum\n- `baa_permitted_uses[]` — anything not listed here is *not* permitted by the\n  agreement (45 CFR 164.504(e)(2)(i))\n\n**Optional:** `baa_electronic_phi` (default `true`),\n`baa_uses_subcontractors` (default `false`), `baa_term_type`,\n`baa_term_end_date`, `baa_breach_notification_days` (1–60, default 30),\n`baa_return_or_destroy`, `baa_include_indemnification`,\n`baa_include_insurance`, `baa_insurance_amount`.\n\nEvery generated agreement is checked against the 15 clauses 45 CFR 164.504(e)\nrequires before it is returned; an incomplete draft is refused rather than\nhanded back. The result is still a draft for counsel to review, and it is\nnever published at a public URL.\n\n## Configuration\n\nOnly needed for the local (npx) transport. Remote connections authenticate\nover OAuth or an `Authorization` header instead.\n\n| Env var | Required | Default | Purpose |\n| --- | --- | --- | --- |\n| `POLICYFORGE_API_KEY` | yes (local only) | — | Your PolicyForge API key. |\n| `POLICYFORGE_API_URL` | no | `https://policyforge.co` | Override the API base URL (self-host/testing). |\n\n## How it works\n\nThis server is a thin wrapper over the PolicyForge public REST API (`/api/v1`).\nEvery tool maps to one authenticated HTTP request, so quota, rate limiting, and\npolicy generation stay authoritative on the PolicyForge server — the MCP layer\nholds no secrets beyond your API key and no business logic of its own.\n\n## License\n\nMIT\n",
  "bytes": 11231,
  "sha": "433a0468c171094202767628090a41c54d75af3406d66711d1cc74784b183522",
  "repo_slug": "policyforge/mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_co_policyforge_mcp_2285d22d/readme"
}