Paperloo Compliance

io.github.yassinemohamedaliPublished by GitHub account yassinemohamedaliv1.0.0Updated Nov 7, 2026

Automated website compliance infrastructure and GDPR/CCPA auditing.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Remote MCP server for website compliance: it lists monitored sites with GDPR/CCPA grades, audits a URL, and generates legal document suites.

What you can do
  • List monitored websites with real-time compliance grades, cookie banner status, GTM container state and document counts
  • Audit a target URL across cookie banners, Google Consent Mode v2 signals, GTM tag firing, legal links and security headers
  • Generate tailored legal document suites such as privacy policy, terms of service, cookie policy, EULA, acceptable use and disclaimer
When to use it
Useful when you want an assistant to check whether a site meets GDPR/CCPA expectations, compare monitored sites by grade, or draft a matching set of legal documents for a website.
Requirements
A remote streamable HTTP endpoint; no packages, environment variables or headers are declared. The README describes a self-hosted setup with Supabase, Google OAuth and Stripe, but that is for the web app, not the MCP connection.
Before you install
Audits and generated documents are automated and grounded in regulator guidance, not legal advice; have a qualified professional review anything you publish. The README's self-hosting path involves Stripe secret keys and webhook secrets and Supabase keys, so keep those out of shared configuration.

Installation

In SourceWeft

  1. Open Paperloo Compliance in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.yassinemohamedali%2Fpaperloo/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "paperloo-compliance": {
      "type": "http",
      "url": "https://paperloo.vercel.app/api/mcp"
    }
  }
}

README

Paperloo - B2B Compliance SaaS Overhaul

Setup Instructions

1. Supabase Setup

  1. Create a new Supabase project.
  2. Run the SQL migration in supabase/migrations/001_init.sql in the SQL Editor.
  3. Enable Google OAuth in Authentication > Providers.
  4. Add the following Redirect URLs in Supabase:
    • http://localhost:3000/dashboard
    • https://your-app-url.run.app/dashboard
  5. Copy your project URL and Anon Key to .env.

2. Stripe Setup

  1. Create a Stripe account.
  2. Create three products for the plans (Starter, Agency, Scale).
  3. Set up a webhook pointing to https://your-project-ref.supabase.co/functions/v1/stripe-webhook.
  4. Add your Stripe keys to Supabase Edge Function secrets:
    bash
    supabase secrets set STRIPE_SECRET_KEY=sk_test_...supabase secrets set STRIPE_WEBHOOK_SECRET=whsec_...supabase secrets set STRIPE_PRICE_STARTER=price_...supabase secrets set STRIPE_PRICE_AGENCY=price_...supabase secrets set STRIPE_PRICE_SCALE=price_...

3. Local Development

  1. npm install
  2. npm run dev

4. Environment Variables

Create a .env file with:

  • VITE_SUPABASE_URL
  • VITE_SUPABASE_ANON_KEY
  • VITE_STRIPE_PUBLISHABLE_KEY

Design System

  • Typography: Syne (Headings), DM Sans (Body)
  • Theme: Dark Mode Only
  • Palette: Custom deep dark palette with indigo accents.

Source: README.md at commit 3e09687

Tools

3

list_sites

Lists all monitored websites, their real-time compliance grades (A+ to F), cookie banner status, GTM container state, and document count.

Parametersfilter

audit_site

Performs multi-vector automated compliance auditing on a target website URL. Checks cookie banner presence, Google Consent Mode v2 signals, GTM tag firing, legal links, and security headers.

Parametersurlrequireddeep_scan

generate_documents

Generates tailored legal document suites (Privacy Policy, Terms of Service, Cookie Policy, EULA, Acceptable Use, Disclaimer) assembled from modular statutory clauses grounded in EDPB, CPPA, and ICO regulator guidance.

ParameterssiteIdwebsite_urlrequiredcompany_namerequiredcontact_emailrequiredjurisdictionscollects_minorsuses_meta_pixelcollects_cookiesphysical_addresshas_user_accountsprocesses_paymentsrefund_period_days+2 more

Version history

1
  1. v1.0.0LatestOct 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.