Policyforge

co.policyforgePublished by policyforge.coOfficial publisherv0.9.0Updated Nov 3, 2026

Generate, audit, and maintain legal policies that match what your code actually does.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

PolicyForge generates, hosts and maintains legal policies such as privacy policies, terms of service and HIPAA BAAs from an AI coding assistant.

What you can do
  • Generate policies and HIPAA BAAs, then poll job status and check remaining quota
  • List, read, update, regenerate, version, restore and delete saved policies
  • Audit compliance gaps and detect drift between a codebase stack manifest and a stored policy
  • Retrieve the disclosure checklist, supported policy types and website embed/link snippets
When to use it
Useful when a project needs privacy, cookie, terms, refund, EULA or disclaimer documents that reflect what the code actually does, or when an existing policy must be audited and kept in sync as integrations change.
Requirements
A PolicyForge account. Remote endpoint with OAuth sign-in, or an API key sent as an Authorization header; the local npx package needs the POLICYFORGE_API_KEY environment variable. Generation quota applies (free tier: 2 per month plus 3 bonus on first MCP connect); audits and drift checks are free.
Before you install
Generating and regenerating consume account quota, and generate_baa requires a Pro plan. delete_policy is permanent and breaks hosted URLs and embeds. Generated documents are drafts listing claims to verify and are not legal advice; BAA output still needs counsel review. The API key grants account access and should be kept secret.

Installation

In SourceWeft

  1. Open Policyforge in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/co.policyforge%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "policyforge": {
      "type": "http",
      "url": "https://policyforge.co/api/mcp"
    }
  }
}

README

PolicyForge MCP Server

Generate legal policies — privacy policies, terms of service, cookie policies, refund policies, EULAs, disclaimers, and HIPAA Business Associate Agreements — directly from your AI coding tools (Claude Code, Cursor, Windsurf, Claude Desktop) via the Model Context Protocol.

Ask your agent "generate a GDPR + CCPA privacy policy for this app" and it fills the details from your codebase, calls PolicyForge, and drops the policy straight into your project.

Try it free: compliance audits (audit_compliance), drift checks (check_policy_freshness), and the scan rubric (get_disclosure_checklist) are unlimited and never touch your quota — start with "audit our compliance — does the privacy policy cover everything this code actually does?". And the first time your account connects through MCP it gets 3 bonus policy generations on top of the free 2/month — enough to generate privacy, terms, and cookie policies for a new project in one conversation.

Connect

Pick the row that matches your client. If you're unsure, start with A.

How you sign inBest for
A. Remote + OAuthBrowser sign-in, no key to copyClients that support OAuth (Claude, ChatGPT)
B. Remote + API keyAuthorization headerAny client that can send a header
C. Local (npx)POLICYFORGE_API_KEY env varRunning the server as a local process

All three expose the same tools. A and B need nothing installed.

A. Remote with OAuth (easiest)

No key to copy, no config file to edit. You'll need a PolicyForge account first — https://policyforge.co, free, no card.

1. Add the server. The -s user makes it available in every project rather than only the directory you ran this in:

bash
claude mcp add -s user --transport http policyforge https://policyforge.co/api/mcp

Note there is no --header. Omitting it is what makes the client use OAuth.

2. Restart your client. MCP config is read at startup, so a session that was already running won't see the new server.

3. Authenticate. Run /mcp, select policyforge, and press Enter:

policyforge · △ needs authentication

Your browser opens, you sign in and approve, and the client stores the token itself. You should land back at /mcp showing ✔ connected · 16 tools.

To confirm from the other side, a key named MCP · <your client> appears at https://policyforge.co/api-dashboard — that's the grant, and deleting it revokes access.

Other clients differ in step 3: some prompt on first tool use rather than offering an explicit authenticate action.

B. Remote with an API key

For clients that don't do OAuth yet. Create a key at https://policyforge.co/api-dashboard, then:

bash
claude mcp add --transport http policyforge https://policyforge.co/api/mcp \  --header "Authorization: Bearer pf_your_key_here"

For clients with URL-based MCP config (Cursor, Windsurf, and others):

json
{  "mcpServers": {    "policyforge": {      "url": "https://policyforge.co/api/mcp",      "headers": { "Authorization": "Bearer pf_your_key_here" }    }  }}

C. Local (npx)

Prefer a local process? The server runs via npx — nothing to install globally. Uses an API key from the environment, which is what the MCP spec recommends for stdio transports.

Claude Code
bash
claude mcp add policyforge \  --env POLICYFORGE_API_KEY=your_key_here \  -- npx -y @policyforge/mcp@latest
Cursor / Claude Desktop / Windsurf

Add to your MCP config (.cursor/mcp.json, claude_desktop_config.json, etc.):

json
{  "mcpServers": {    "policyforge": {      "command": "npx",      "args": ["-y", "@policyforge/mcp@latest"],      "env": {        "POLICYFORGE_API_KEY": "your_key_here"      }    }  }}

On Windows, some clients need the command wrapped: set "command": "cmd" and "args": ["/c", "npx", "-y", "@policyforge/mcp@latest"].

See https://policyforge.co/mcp for one-click installs (Cursor/VS Code) and per-client instructions — with your API key pre-filled when signed in.

Troubleshooting

  • 401 — if you connected with OAuth, the authorization was revoked or expired: reconnect and approve again. If you used an API key, it was deleted, disabled, or mistyped (keys start with pf_) — rotate or create one at https://policyforge.co/api-dashboard and restart the client.
  • 402 — generation quota exhausted. Free tier: 2 generations per calendar month, plus a one-time bonus of 3 extra generations on first MCP connect. Only generate_policy/regenerate_policy consume quota — audits and drift checks are free; ask your agent to run get_usage to see what's left.
  • 429 — request rate limit (free tier: 10/minute, 100/day); the response includes retry_after.
  • Server not listed in /mcp — either the session started before you added it (restart the client; config is read at startup), or it was added to a different project scope. claude mcp add -s user … makes it available everywhere.
  • Tools missing — restart the client after config changes; on Windows use the cmd wrapper above.
  • "The redirect URI is not registered for this application" — the client is using a callback URL we haven't seen. Loopback callbacks work on any port (per RFC 8252), so this should be rare; report the exact URI and it can be supported.

More detail: https://policyforge.co/mcp#troubleshooting

Tools

ToolWhat it does
generate_policyGenerate a policy and return its Markdown content + hosted URL. Consumes one policy from your quota.
generate_baaGenerate a HIPAA Business Associate Agreement between a covered entity and a vendor handling PHI. Built from the clauses required by 45 CFR 164.504(e) and validated clause by clause. Pro plan; never publicly hosted. Consumes one policy from your quota.
regenerate_policyRe-run the AI engine with changed business context — same ID and hosted URL, previous content saved as a version.
check_generationGet the result of a generation that was still running when its tool returned a job ID (generation takes 40-60s; tools wait up to 45s).
update_policyEdit a policy in place with find/replace edits or full content — same ID and hosted URL, so published links keep working.
audit_complianceGap analysis: compare what the code does (your scanned manifest) with what a policy discloses.
check_policy_freshnessDrift detection: diff the current codebase scan against the manifest stored at generation time.
list_policy_versionsVersion history — a snapshot is saved before every update, regeneration, or restore.
restore_policy_versionRoll a policy back to any previous version (itself reversible).
list_policiesList policies on your account (filter by type/status, paginate).
get_policyFetch a single policy by ID, including full content.
delete_policyPermanently delete a policy (its hosted URL stops working).
get_usageCheck your tier and remaining generation quota before generating.
get_disclosure_checklistThe codebase-scan rubric: which SDKs/patterns require disclosure and how findings map to generate_policy fields.
get_integration_guideCopy-paste embed/link instructions for Next.js, React, plain HTML, or WordPress.
list_policy_typesList supported policy types, business types, and jurisdictions.

The codebase-aware workflow

Your agent can read your project — so policies come from what the code actually does, not what you remember it doing:

  1. get_disclosure_checklist → agent scans dependencies, script tags, cookie writes, and outbound hosts against the rubric, and builds a stack manifest of what it found
  2. generate_policy with the detected context + stack_manifest (stored server-side for drift detection)
  3. get_integration_guide → agent wires the hosted policy into your footer
  4. Later, after the stack changes: check_policy_freshness reports the drift, audit_compliance shows the concrete gaps, and regenerate_policy fixes them — same hosted URL, no broken links, previous version restorable

generate_policy inputs

Required: type, business_type, jurisdiction, company_name, contact_email

  • type — privacy_policy · terms_of_service · cookie_policy · refund_policy · eula · disclaimer
  • business_type — e-commerce · saas · healthcare · education · financial · fintech · real-estate · non-profit · consulting · media · mobile_app · other
  • jurisdiction — one or more of gdpr ccpa pipeda lgpd us eu ca uk au br global (comma-separate to combine, e.g. gdpr,ccpa)

Optional context (improves output): website_url, service_description, data_collection[], third_party_integrations[], data_retention, user_accounts, payments, marketing, analytics, cookies, children_data, sells_data, target_audience[], security_measures[], governing_law, physical_address, dpo_email, consent_tracking, hosting_enabled.

generate_baa inputs

A Business Associate Agreement is a contract between two named parties, not a published policy, so it takes its own tool and its own fields. Pro plan.

Required: acknowledge_contract (must be true), baa_direction, company_name, contact_email, both parties' legal names and addresses, baa_effective_date (YYYY-MM-DD), baa_services_description, baa_phi_types[], baa_permitted_uses[], baa_governing_law_state.

  • baa_direction — covered_entity_to_vendor (you are the practice issuing the agreement) or business_associate_to_client (you are the vendor offering it to a healthcare client)
  • baa_phi_types[] — categories of PHI involved. Including "Substance use treatment records (42 CFR Part 2)" adds a Part 2 addendum
  • baa_permitted_uses[] — anything not listed here is not permitted by the agreement (45 CFR 164.504(e)(2)(i))

Optional: baa_electronic_phi (default true), baa_uses_subcontractors (default false), baa_term_type, baa_term_end_date, baa_breach_notification_days (1–60, default 30), baa_return_or_destroy, baa_include_indemnification, baa_include_insurance, baa_insurance_amount.

Every generated agreement is checked against the 15 clauses 45 CFR 164.504(e) requires before it is returned; an incomplete draft is refused rather than handed back. The result is still a draft for counsel to review, and it is never published at a public URL.

Configuration

Only needed for the local (npx) transport. Remote connections authenticate over OAuth or an Authorization header instead.

Env varRequiredDefaultPurpose
POLICYFORGE_API_KEYyes (local only)—Your PolicyForge API key.
POLICYFORGE_API_URLnohttps://policyforge.coOverride the API base URL (self-host/testing).

How it works

This server is a thin wrapper over the PolicyForge public REST API (/api/v1). Every tool maps to one authenticated HTTP request, so quota, rate limiting, and policy generation stay authoritative on the PolicyForge server — the MCP layer holds no secrets beyond your API key and no business logic of its own.

License

MIT

Source: README.md at commit 5e8563a

Tools

16

generate_policy

Generate policy

Generates a legal policy (privacy policy, terms of service, cookie policy, refund policy, EULA or disclaimer) for a business, saves it to the PolicyForge account, and returns the Markdown content and a hosted URL. Uses one document from the account's quota. The optional fields describe what the product does (data collected, third-party services, payments, analytics, cookies), and the document is more accurate when they reflect the product's actual code and configuration. Company facts such as the legal name, contact email, physical address and governing law come from the user. For terms_of_service, eula and disclaimer, a document generated without governing_law or physical_address contains a placeholder where the governing law goes. The result lists claims to verify: statements about third parties, certifications or deadlines that the inputs did not supply. Generation takes 40 to 60 seconds. If it is not finished within about 45 seconds, the tool returns a job ID instead of the document and the job keeps running; calling generate_policy again starts a separate document and uses more quota.

Parameterstyperequiredcookiespaymentsanalyticsdpo_emailmarketingsells_datawebsite_urlcompany_namerequiredjurisdictionrequiredbusiness_typerequiredchildren_data+14 more

generate_baa

Generate a HIPAA Business Associate Agreement

Generates a HIPAA Business Associate Agreement (BAA) between a covered entity and a vendor that handles Protected Health Information, built from the clauses required by 45 CFR 164.504(e) and validated clause by clause. A BAA is a binding two-party contract rather than a published policy: it needs both parties' legal names and addresses, an effective date and a governing law state, and it is never hosted at a public URL. Requires a Pro plan. The result is a draft for counsel to review, not legal advice. If it is not finished within about 45 seconds, the tool returns a job ID instead of the document and the job keeps running.

Parameterscompany_namerequiredbaa_directionrequiredbaa_phi_typesrequiredbaa_term_typecontact_emailrequiredbaa_term_end_datebaa_effective_daterequiredbaa_electronic_phibaa_permitted_usesrequiredacknowledge_contractrequiredbaa_insurance_amountbaa_include_insurance+10 more

list_policies

List policies

Lists the policies saved on this PolicyForge account, newest first, with optional filters by status and type.

ParameterstypelimitoffsetsortBystatussortOrder

get_policy

Get policy

Returns one policy by ID, including its status, hosted URL and full Markdown content.

Parametersidrequired

check_generation

Check generation

Returns the state of a policy generation job: the finished document, the error if generation failed, or a note that it is still running. Takes the job ID that generate_policy, generate_baa or regenerate_policy returns when generation runs longer than about 45 seconds.

Parametersjob_idrequired

update_policy

Update policy

Updates an existing policy in place. The policy ID, hosted URL and embeds stay the same, so links already published on a site keep working. Accepts small find-and-replace changes as `edits` or a complete revised document as `content`, and can also change the title, status, effective date, hosting and consent banner. The previous content is saved as a version first, so an update can be undone. Does not use generation quota.

Parametersidrequirededitstitlestatuscontenteffective_datehosting_enabledconsent_tracking

regenerate_policy

Regenerate policy

Re-runs AI generation for an existing policy, using its stored business details merged with the changed fields provided. The policy ID and hosted URL stay the same, so published links keep working, and the previous content is saved as a version first. Suited to substantial changes such as new integrations, a new jurisdiction or a renamed company. Uses one document from the account's quota. If it is not finished within about 45 seconds, the tool returns a job ID instead of the document and the job keeps running.

Parametersidrequiredcookiespaymentsanalyticsdpo_emailmarketingsells_datawebsite_urlcompany_namejurisdictionbusiness_typechildren_data+12 more

audit_compliance

Audit compliance

Compliance gap analysis. Compares a stack manifest (the services, cookies and personal data a product uses) with a saved policy and returns missing disclosures, overstated claims, missing policy types and recommendations. Without a policy_id, it reports which policies the stack needs and what they must cover. Does not use generation quota.

Parametersmanifestrequiredpolicy_id

check_policy_freshness

Check policy freshness

Compares a current stack manifest with the one stored when the policy was last generated or regenerated, and reports what changed in the stack, which shows whether the policy still matches the product. Works on the two manifests only: no AI call and no quota.

Parametersidrequiredcurrent_manifestrequired

list_policy_versions

List policy versions

Lists a policy's version history: a snapshot taken before every update, regeneration or restore, plus any auto-generated compliance update drafts, each with its version number.

Parametersidrequired

restore_policy_version

Restore policy version

Restores a policy to an earlier version by version number. The current content is saved as a new version first, so a restore can itself be undone. The hosted URL does not change.

Parametersidrequiredversionrequired

delete_policy

Delete policy

Permanently deletes a policy. Its hosted URL and any embeds of it stop working immediately, and the deletion cannot be undone.

Parametersidrequired

get_usage

Get usage & quota

Returns the account's plan and its remaining document generation quota.

Takes no parameters.

get_disclosure_checklist

Get disclosure checklist

Returns PolicyForge's disclosure checklist: the SDKs, scripts and code patterns that legally require disclosure in a privacy or cookie policy, and how each one maps to generate_policy's fields and the stack manifest format.

Takes no parameters.

get_integration_guide

Get integration guide

Returns snippets for adding a policy to a website: the hosted link, an embed snippet, and where to place them in the chosen framework (Next.js, React, WordPress or plain HTML).

Parametersidrequiredframework

list_policy_types

List policy types

Lists the policy types, business types and jurisdictions that generate_policy accepts.

Takes no parameters.

Version history

4
  1. v0.9.0LatestOct 31, 2026
  2. v0.8.0Sep 29, 2026
  3. v0.7.0Sep 29, 2026
  4. v0.6.1Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.