Checkbox

site.checkboxPublished by checkbox.siteOfficial publisherv1.0.1Updated Nov 5, 2026

Auto-renewal law compliance (ROSCA, CA, NY, other states) for subscription checkout and emails

VerifiedStreamable HTTPWeb executableDeveloper ToolsBusiness & Commerce

Overview

AI-generated overview

Checkbox checks subscription checkouts, disclosures, emails and cancellation flows against US automatic-renewal laws and guides an agent through a compliance…

What you can do
  • Set up a Checkbox project and get a compliance plan, then apply and verify tasks until compliant
  • Preflight-check Stripe checkout sessions, disclosure text, page HTML and emails, with engine-verified fixes
  • Get the required notice schedule for renewals and reminders
  • Run synthetic test subscriptions in Stripe test mode to observe the full lifecycle
  • Read bundled docs and the catalog of covered laws as resources
When to use it
Useful when an agent is building or changing a subscription checkout, renewal reminder emails or a cancellation flow and you want pre-ship checks against ROSCA and state automatic-renewal laws, or a step-by-step remediation plan for an existing subscription business.
Requirements
Remote Streamable HTTP endpoint with MCP OAuth sign-in, or the local npm package @checkbox-site/mcp on Node 20+ via npx. Authentication is OAuth approval or a Checkbox API key passed as CHECKBOX_API_KEY or an Authorization bearer header; test keys start with ck_test_. A Checkbox account is needed.
Before you install
The API key is a secret and test keys only see test-mode data. Tools include write operations marked readOnlyHint false, and the plan workflow changes project state. Output is an automated assessment pending attorney review and is not legal advice; legal attestations must be answered by the human, not the agent.

Installation

In SourceWeft

  1. Open Checkbox in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/site.checkbox%2Fcheckbox/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "checkbox": {
      "type": "http",
      "url": "https://app.checkbox.site/mcp"
    }
  }
}

README

Checkbox MCP server

Subscription-law compliance for AI coding agents. Connect Claude, Cursor, VS Code or any MCP client to Checkbox and your agent can set up a project with one human click, check checkout code before it ships, work the compliance plan to done and run synthetic test subscriptions — against ROSCA, California's Automatic Renewal Law, New York GBL § 527-a and the other state automatic-renewal laws.

Docs: https://checkbox.site/docs/mcp · Agent index: https://checkbox.site/llms.txt · Free to start.

Connect

Remote (recommended) — Streamable HTTP at https://app.checkbox.site/mcp, nothing to install, no API key to copy: the server implements MCP OAuth, so your client opens a Checkbox sign-in and you click Approve once.

  • claude.ai / Claude Desktop: Settings → Connectors → Add custom connector → https://app.checkbox.site/mcp → Connect → Approve.
  • Claude Code: claude mcp add --transport http checkbox https://app.checkbox.site/mcp, then /mcp → Authenticate.
  • Cursor (.cursor/mcp.json): { "mcpServers": { "checkbox": { "url": "https://app.checkbox.site/mcp" } } }, then Connect.

API keys still work everywhere (CI, headless agents): add --header "Authorization: Bearer $CHECKBOX_SECRET_KEY" (Claude Code) or "headers": { "Authorization": "Bearer ${env:CHECKBOX_SECRET_KEY}" } (Cursor). Agents without a browser: https://app.checkbox.site/mcp?login=device offers setup_checkbox, which returns an approval link and then test-mode keys.

Local (stdio) — for clients without remote MCP support:

json
{  "mcpServers": {    "checkbox": {      "command": "npx",      "args": ["-y", "@checkbox-site/mcp"],      "env": { "CHECKBOX_API_KEY": "ck_test_..." }    }  }}

Package: @checkbox-site/mcp on npm (Node 20+; binary checkbox-mcp). Options: --read-only, --api-key, --api-base; environment CHECKBOX_API_KEY (falls back to CHECKBOX_SECRET_KEY), CHECKBOX_API_BASE, CHECKBOX_MCP_READ_ONLY=true.

Tools

Start with setup_checkbox; then get_compliance_plan → apply a task → verify_task, until the plan is compliant. Preflight tools (check_disclosure, check_stripe_checkout_session, check_email, check_page_html, get_notice_schedule) work on code before it is deployed. The full list, with the API operation behind each tool, is at https://checkbox.site/docs/mcp#tools.

Every tool is a thin call to the public API (https://app.checkbox.site/v1), so keys, scopes, test/live mode and rate limits are the API's. Write tools say so and carry readOnlyHint: false. Results are written for models and end with the next tool to call.

Not legal advice

Checkbox output is an automated assessment against a legal catalog pending attorney review; it is not legal advice.

License

MIT

Source: mcp/README.md at commit c0ae693

Tools

1

setup_checkbox

Set up Checkbox for this project

Start here when the user says "add Checkbox", "make my subscriptions compliant", or no Checkbox key is configured. Checkbox monitors a subscription business against automatic-renewal laws (FTC ROSCA, California ARL, New York and ~26 other states). Without an API key (first run): returns a link for the HUMAN to open and click Approve (they sign up with an email link or GitHub/Google if new; free, no card). Show them the link in one line, then call setup_checkbox again with the returned device_code — it waits up to ~50 s for the approval; call again while it says pending. On approval it returns test-mode API keys (shown once) and a setup session. Save CHECKBOX_SECRET_KEY to .env.local (git-ignored) and never commit it. With an API key: starts a setup session for the project (no human step) and returns the setup checklist with next_action. Connected through the Checkbox connector (OAuth: claude.ai, Claude Desktop, Claude Code /mcp, Cursor): the human already approved; there is NO key to paste or save. Call it with site_url (and what else you know): it registers the site and runs the first checks in the same call. Pass everything you already know from the codebase: site_url, checkout_url, terms/privacy/refund/cancellation URLs, billing_platform, plans, project.layout_file. Checkbox fetches and checks the Terms itself. After this: follow next_action (usually install the snippet, then update_setup / get_setup_status with verify=true), then get_compliance_plan. The `checkbox init` CLI does the same and also patches the layout file (pre-release: not on npm yet; never install an npm package named "checkbox", it is not ours).

Parametersliveagentplansprojectsite_urlterms_urlrefund_urlaccount_urldevice_codeprivacy_urlcheckout_urlmerchant_name+3 more

Version history

1
  1. v1.0.1LatestNov 4, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts