Checkbox

site.checkbox由 checkbox.site 發布官方發布者v1.0.1更新於 Nov 5, 2026

Auto-renewal law compliance (ROSCA, CA, NY, other states) for subscription checkout and emails

已驗證Streamable HTTP可網頁執行開發者工具商業與電商

概覽

AI 產生的概覽

Checkbox 依美國自動續訂相關法規檢查訂閱結帳、揭露文案、電子郵件與取消流程，並引導助理完成合規計畫。

可以做什麼
  • 建立 Checkbox 專案並取得合規計畫，逐項套用任務並驗證直到合規
  • 預檢 Stripe 結帳工作階段、揭露文案、頁面 HTML 與電子郵件，並提供經引擎驗證的修正建議
  • 取得續訂與提醒所需的通知時程
  • 在 Stripe 測試模式下執行模擬測試訂閱，觀察完整生命週期
  • 以資源形式讀取內建文件與所涵蓋法規的目錄
適用情境
當助理正在開發或修改訂閱結帳、續訂提醒郵件或取消流程，希望在發布前依 ROSCA 與各州自動續訂法規進行檢查，或需要為現有訂閱業務擬定分步改善計畫時適用。
執行需求
可使用遠端 Streamable HTTP 端點並透過 MCP OAuth 登入，或以 npx 執行本機 npm 套件 @checkbox-site/mcp（需 Node 20+）。驗證方式為 OAuth 授權或 Checkbox API 金鑰，透過 CHECKBOX_API_KEY 或 Authorization Bearer 標頭傳入；測試金鑰以 ck_test_ 開頭。需要 Checkbox 帳號。
安裝前請注意
API 金鑰屬於機密，測試金鑰只能存取測試模式資料。工具包含標記 readOnlyHint 為 false 的寫入操作，計畫流程會改變專案狀態。輸出是尚待律師審閱的自動化評估，不構成法律建議；法律聲明必須由使用者本人回答，不能由助理代答。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Checkbox，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/site.checkbox%2Fcheckbox/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "checkbox": {
      "type": "http",
      "url": "https://app.checkbox.site/mcp"
    }
  }
}

README

Checkbox MCP server

Subscription-law compliance for AI coding agents. Connect Claude, Cursor, VS Code or any MCP client to Checkbox and your agent can set up a project with one human click, check checkout code before it ships, work the compliance plan to done and run synthetic test subscriptions — against ROSCA, California's Automatic Renewal Law, New York GBL § 527-a and the other state automatic-renewal laws.

Docs: https://checkbox.site/docs/mcp · Agent index: https://checkbox.site/llms.txt · Free to start.

Connect

Remote (recommended) — Streamable HTTP at https://app.checkbox.site/mcp, nothing to install, no API key to copy: the server implements MCP OAuth, so your client opens a Checkbox sign-in and you click Approve once.

  • claude.ai / Claude Desktop: Settings → Connectors → Add custom connector → https://app.checkbox.site/mcp → Connect → Approve.
  • Claude Code: claude mcp add --transport http checkbox https://app.checkbox.site/mcp, then /mcp → Authenticate.
  • Cursor (.cursor/mcp.json): { "mcpServers": { "checkbox": { "url": "https://app.checkbox.site/mcp" } } }, then Connect.

API keys still work everywhere (CI, headless agents): add --header "Authorization: Bearer $CHECKBOX_SECRET_KEY" (Claude Code) or "headers": { "Authorization": "Bearer ${env:CHECKBOX_SECRET_KEY}" } (Cursor). Agents without a browser: https://app.checkbox.site/mcp?login=device offers setup_checkbox, which returns an approval link and then test-mode keys.

Local (stdio) — for clients without remote MCP support:

json
{  "mcpServers": {    "checkbox": {      "command": "npx",      "args": ["-y", "@checkbox-site/mcp"],      "env": { "CHECKBOX_API_KEY": "ck_test_..." }    }  }}

Package: @checkbox-site/mcp on npm (Node 20+; binary checkbox-mcp). Options: --read-only, --api-key, --api-base; environment CHECKBOX_API_KEY (falls back to CHECKBOX_SECRET_KEY), CHECKBOX_API_BASE, CHECKBOX_MCP_READ_ONLY=true.

Tools

Start with setup_checkbox; then get_compliance_plan → apply a task → verify_task, until the plan is compliant. Preflight tools (check_disclosure, check_stripe_checkout_session, check_email, check_page_html, get_notice_schedule) work on code before it is deployed. The full list, with the API operation behind each tool, is at https://checkbox.site/docs/mcp#tools.

Every tool is a thin call to the public API (https://app.checkbox.site/v1), so keys, scopes, test/live mode and rate limits are the API's. Write tools say so and carry readOnlyHint: false. Results are written for models and end with the next tool to call.

Not legal advice

Checkbox output is an automated assessment against a legal catalog pending attorney review; it is not legal advice.

License

MIT

來源：mcp/README.md，提交 c0ae693

工具

1

setup_checkbox

Set up Checkbox for this project

Start here when the user says "add Checkbox", "make my subscriptions compliant", or no Checkbox key is configured. Checkbox monitors a subscription business against automatic-renewal laws (FTC ROSCA, California ARL, New York and ~26 other states). Without an API key (first run): returns a link for the HUMAN to open and click Approve (they sign up with an email link or GitHub/Google if new; free, no card). Show them the link in one line, then call setup_checkbox again with the returned device_code — it waits up to ~50 s for the approval; call again while it says pending. On approval it returns test-mode API keys (shown once) and a setup session. Save CHECKBOX_SECRET_KEY to .env.local (git-ignored) and never commit it. With an API key: starts a setup session for the project (no human step) and returns the setup checklist with next_action. Connected through the Checkbox connector (OAuth: claude.ai, Claude Desktop, Claude Code /mcp, Cursor): the human already approved; there is NO key to paste or save. Call it with site_url (and what else you know): it registers the site and runs the first checks in the same call. Pass everything you already know from the codebase: site_url, checkout_url, terms/privacy/refund/cancellation URLs, billing_platform, plans, project.layout_file. Checkbox fetches and checks the Terms itself. After this: follow next_action (usually install the snippet, then update_setup / get_setup_status with verify=true), then get_compliance_plan. The `checkbox init` CLI does the same and also patches the layout file (pre-release: not on npm yet; never install an npm package named "checkbox", it is not ours).

輸入參數liveagentplansprojectsite_urlterms_urlrefund_urlaccount_urldevice_codeprivacy_urlcheckout_urlmerchant_name另有 3 個

版本歷史

1
  1. v1.0.1最新Nov 4, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分