Checkbox

site.checkbox由 checkbox.site 发布官方发布者v1.0.1更新于 Nov 5, 2026

Auto-renewal law compliance (ROSCA, CA, NY, other states) for subscription checkout and emails

已验证Streamable HTTP可网页运行开发者工具商业与电商

概览

AI 生成的概览

Checkbox 依据美国自动续订相关法律检查订阅结账、披露文案、邮件与取消流程，并引导助手完成合规计划。

可以做什么
  • 创建 Checkbox 项目并获取合规计划，逐项应用任务并验证直至合规
  • 预检 Stripe 结账会话、披露文案、页面 HTML 与邮件，并给出经引擎验证的修改建议
  • 获取续订与提醒所需的通知时间表
  • 在 Stripe 测试模式下运行模拟测试订阅，观察完整生命周期
  • 以资源形式读取内置文档与所覆盖法律的目录
适用场景
当助手正在开发或修改订阅结账、续订提醒邮件或取消流程，希望在发布前依据 ROSCA 与各州自动续订法律做检查，或需要为现有订阅业务制定分步整改计划时适用。
运行要求
可使用远程 Streamable HTTP 端点并通过 MCP OAuth 登录，或通过 npx 运行本地 npm 包 @checkbox-site/mcp（需 Node 20+）。认证方式为 OAuth 授权或 Checkbox API 密钥，通过 CHECKBOX_API_KEY 或 Authorization Bearer 头传入；测试密钥以 ck_test_ 开头。需要 Checkbox 账户。
安装前请注意
API 密钥属于机密，测试密钥只能访问测试模式数据。工具中包含标记 readOnlyHint 为 false 的写入操作，计划流程会改变项目状态。输出是尚待律师审核的自动评估，不构成法律建议；法律声明必须由用户本人回答，不能由助手代答。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Checkbox，将其添加到工作区。
  2. 连接 所需的 凭据。它们会被私密存储，绝不会在公开页面上展示。
  3. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/site.checkbox%2Fcheckbox/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。 客户端会在首次连接时完成 OAuth 登录。

{
  "mcpServers": {
    "checkbox": {
      "type": "http",
      "url": "https://app.checkbox.site/mcp"
    }
  }
}

README

Checkbox MCP server

Subscription-law compliance for AI coding agents. Connect Claude, Cursor, VS Code or any MCP client to Checkbox and your agent can set up a project with one human click, check checkout code before it ships, work the compliance plan to done and run synthetic test subscriptions — against ROSCA, California's Automatic Renewal Law, New York GBL § 527-a and the other state automatic-renewal laws.

Docs: https://checkbox.site/docs/mcp · Agent index: https://checkbox.site/llms.txt · Free to start.

Connect

Remote (recommended) — Streamable HTTP at https://app.checkbox.site/mcp, nothing to install, no API key to copy: the server implements MCP OAuth, so your client opens a Checkbox sign-in and you click Approve once.

  • claude.ai / Claude Desktop: Settings → Connectors → Add custom connector → https://app.checkbox.site/mcp → Connect → Approve.
  • Claude Code: claude mcp add --transport http checkbox https://app.checkbox.site/mcp, then /mcp → Authenticate.
  • Cursor (.cursor/mcp.json): { "mcpServers": { "checkbox": { "url": "https://app.checkbox.site/mcp" } } }, then Connect.

API keys still work everywhere (CI, headless agents): add --header "Authorization: Bearer $CHECKBOX_SECRET_KEY" (Claude Code) or "headers": { "Authorization": "Bearer ${env:CHECKBOX_SECRET_KEY}" } (Cursor). Agents without a browser: https://app.checkbox.site/mcp?login=device offers setup_checkbox, which returns an approval link and then test-mode keys.

Local (stdio) — for clients without remote MCP support:

json
{  "mcpServers": {    "checkbox": {      "command": "npx",      "args": ["-y", "@checkbox-site/mcp"],      "env": { "CHECKBOX_API_KEY": "ck_test_..." }    }  }}

Package: @checkbox-site/mcp on npm (Node 20+; binary checkbox-mcp). Options: --read-only, --api-key, --api-base; environment CHECKBOX_API_KEY (falls back to CHECKBOX_SECRET_KEY), CHECKBOX_API_BASE, CHECKBOX_MCP_READ_ONLY=true.

Tools

Start with setup_checkbox; then get_compliance_plan → apply a task → verify_task, until the plan is compliant. Preflight tools (check_disclosure, check_stripe_checkout_session, check_email, check_page_html, get_notice_schedule) work on code before it is deployed. The full list, with the API operation behind each tool, is at https://checkbox.site/docs/mcp#tools.

Every tool is a thin call to the public API (https://app.checkbox.site/v1), so keys, scopes, test/live mode and rate limits are the API's. Write tools say so and carry readOnlyHint: false. Results are written for models and end with the next tool to call.

Not legal advice

Checkbox output is an automated assessment against a legal catalog pending attorney review; it is not legal advice.

License

MIT

来源：mcp/README.md，提交 c0ae693

工具

1

setup_checkbox

Set up Checkbox for this project

Start here when the user says "add Checkbox", "make my subscriptions compliant", or no Checkbox key is configured. Checkbox monitors a subscription business against automatic-renewal laws (FTC ROSCA, California ARL, New York and ~26 other states). Without an API key (first run): returns a link for the HUMAN to open and click Approve (they sign up with an email link or GitHub/Google if new; free, no card). Show them the link in one line, then call setup_checkbox again with the returned device_code — it waits up to ~50 s for the approval; call again while it says pending. On approval it returns test-mode API keys (shown once) and a setup session. Save CHECKBOX_SECRET_KEY to .env.local (git-ignored) and never commit it. With an API key: starts a setup session for the project (no human step) and returns the setup checklist with next_action. Connected through the Checkbox connector (OAuth: claude.ai, Claude Desktop, Claude Code /mcp, Cursor): the human already approved; there is NO key to paste or save. Call it with site_url (and what else you know): it registers the site and runs the first checks in the same call. Pass everything you already know from the codebase: site_url, checkout_url, terms/privacy/refund/cancellation URLs, billing_platform, plans, project.layout_file. Checkbox fetches and checks the Terms itself. After this: follow next_action (usually install the snippet, then update_setup / get_setup_status with verify=true), then get_compliance_plan. The `checkbox init` CLI does the same and also patches the layout file (pre-release: not on npm yet; never install an npm package named "checkbox", it is not ours).

输入参数liveagentplansprojectsite_urlterms_urlrefund_urlaccount_urldevice_codeprivacy_urlcheckout_urlmerchant_name另有 3 个

版本历史

1
  1. v1.0.1最新Nov 4, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分