12 PolicyForge MCP Use Cases: Generate & Maintain Legal Policies from Claude Code, Cursor & ChatGPT
Your AI coding assistant can already read your codebase. Connect it to the PolicyForge MCP server and it can also generate a privacy policy that matches what your code actually does, audit your existing policies for gaps, and keep everything current as your stack changes — all from a prompt. Here are 12 practical use cases, each with a copy-paste prompt, ordered from instant wins to continuous compliance.
Setup: Connect in One Command
New to MCP? Read our plain-English explainer, What is an MCP server?, first. The short version: MCP (Model Context Protocol) is the standard that lets AI assistants like Claude Code, Cursor, and ChatGPT call external tools. The PolicyForge MCP server exposes policy generation, auditing, and versioning as tools your assistant can call directly.
There are two ways to connect. The remote server works with any MCP client and needs no install:
claude mcp add --transport http policyforge https://policyforge.co/api/mcp --header "Authorization: Bearer your_key_here"Or run the local stdio server (for example in Claude Code):
claude mcp add policyforge --env POLICYFORGE_API_KEY=your_key_here -- npx -y @policyforge/mcp@latestGrab your API key from the PolicyForge API dashboard — the free tier includes 2 policy generations per month, no credit card required. Using Cursor, Windsurf, or Claude Desktop? The PolicyForge MCP page has one-click install buttons for each client.
Tier 1 — Instant Wins (Under 2 Minutes)
Start here. These four use cases need nothing but a connected MCP server and a single prompt, and the first one is the reason most developers connect at all.
Generate a privacy policy that matches your actual codebase
This is the flagship use case, and the reason to run PolicyForge inside a coding agent instead of a browser form. Your AI assistant can already read your code, so let it inventory the SDKs you actually ship — analytics, auth, payments, error tracking — and feed that inventory into generate_policy. The result is a privacy policy that discloses what your app really does, not what a generic template guesses.
Scan this project for analytics, auth, payment and tracking SDKs, then generate a GDPR + CCPA privacy policy for it with PolicyForge. List the third-party services you found before generating so I can confirm the inventory is right.Generate the full startup legal stack in one conversation
Launching a SaaS usually means you need at least three documents: a privacy policy, terms of service, and a cookie policy. Because the MCP server exposes generate_policy for every supported policy type, one conversation can produce all three with consistent company details and consistent disclosures. Do this once at launch instead of stitching together three different template sites.
Using PolicyForge, generate a complete legal stack for my SaaS: a privacy policy, terms of service, and a cookie policy. Company: Acme Metrics, website https://acmemetrics.io, contact legal@acmemetrics.io. We serve customers in the EU and US. Reuse the same company details across all three documents.Check which policy types and jurisdictions are supported
Before you ask for anything exotic, ask the server what it can do. list_policy_types returns the catalog of supported document types (privacy, terms, cookie, refund, disclaimer, EULA) and the jurisdictions each one can target. It is also a handy way to confirm your MCP connection works before you spend quota on a real generation.
Call PolicyForge's list_policy_types tool and show me every policy type and jurisdiction it supports. Which of these apply to a mobile app with users in the EU, UK, and California?Check your remaining quota before generating
The free tier includes 2 policy generations per month, so it pays to know where you stand before kicking off a batch. get_usage reports your current plan and how many generations you have left this cycle. Agents can call it defensively — before a multi-policy run — so you never burn your last generation on a draft you did not need.
Check my PolicyForge usage with get_usage. How many policy generations do I have left this month, and is that enough to generate a privacy policy and a terms of service today?Two minutes to your first policy
Connect the PolicyForge MCP server and try use case #1 on your own repo. Free tier, no credit card.
Tier 2 — Workflow Upgrades
Once you have policies, the interesting work is keeping them honest. These use cases pair PolicyForge's tools with your assistant's ability to read code — auditing, editing, and integrating without leaving your editor.
Audit an existing policy against your code
The scariest compliance gap is the one between what your code does and what your policy says. audit_compliance reviews a policy for gaps against the frameworks you care about, and your coding agent supplies the other half: a fresh scan of the SDKs and data flows actually in the repo. Run this when you inherit a codebase, or any time the policy was written before the last few product cycles.
Compare what this codebase actually does with what our privacy policy discloses. First scan the repo for third-party services, data collection, and tracking. Then run PolicyForge's audit_compliance on our current privacy policy and list every gap between the code and the policy, ordered by severity.Update a policy in place without breaking its public URL
Every PolicyForge policy gets a hosted public URL, and update_policy edits the document behind that URL in place — so the link in your app footer, your app store listing, and your signup flow never goes stale. Use it for surgical changes: a new contact email, an added subprocessor, a corrected retention period. No re-publishing, no redirect chains.
Fetch our privacy policy from PolicyForge with get_policy, then use update_policy to add Intercom as a third-party service under the data sharing section and change the contact email to privacy@acmemetrics.io. Keep the hosted URL unchanged and show me a diff of what you edited.Regenerate a policy after a business change
When the change is bigger than an edit — you started selling to EU customers, added a mobile app, or began processing payments — regenerate_policy rebuilds the document from scratch with your new answers while keeping the same policy ID and hosted URL. The previous version is snapshotted automatically before regeneration, so you can always look back at what you used to publish.
Our business changed: we now offer a paid plan with Stripe billing and we launched an iOS app. Use PolicyForge's regenerate_policy on our existing privacy policy to reflect the new data practices. Keep the same policy ID and public URL, and confirm the old version was snapshotted.Get framework-specific embed code
A generated policy is only useful once it is wired into your product. get_integration_guide returns embed instructions and code for your stack — Next.js, React, plain HTML, or WordPress — so your agent can fetch the guide and then apply it directly to your repo in the same conversation. Generate, integrate, and open the PR without leaving your editor.
Use PolicyForge's get_integration_guide to get the Next.js embed instructions for our privacy policy, then add a /privacy route to this app that follows the guide and link it from the site footer.Use the disclosure checklist as a code-scanning rubric
get_disclosure_checklist returns the disclosure items a given policy type should cover. Instead of reading it yourself, hand it to your agent as a rubric: for each checklist item, the agent greps the codebase for evidence that the disclosure applies. It turns a legal checklist into a systematic, repeatable code review.
Get the privacy policy disclosure checklist from PolicyForge with get_disclosure_checklist. Then go through this codebase item by item: for each disclosure, tell me whether our code triggers it (with the file and line as evidence) and whether our current privacy policy covers it.Tier 3 — Continuous Compliance
The end state: compliance as a habit, not a fire drill. These use cases turn the tools above into a repeatable loop that runs whenever your stack changes or a release ships.
Detect policy drift when your stack changes
Policies rot silently: you add an analytics SDK on a Tuesday and nobody thinks about the privacy policy. check_policy_freshness reports how stale a policy is and whether it needs attention, and combined with a quick repo scan it answers the real question — has the code moved on since this document was written? Run it after any dependency change that touches user data.
We just added Stripe and PostHog to this project — is our privacy policy stale? Run PolicyForge's check_policy_freshness on it, then scan the repo for any other recently added services the policy might not mention.Browse version history and roll back a policy
Every regeneration and update leaves a version behind, and list_policy_versions shows the full history of a policy. If an update went wrong — or legal wants to see exactly what was published last quarter — restore_policy_version rolls the hosted document back to any earlier snapshot. It is git-style safety for your legal pages.
Show me the version history of our privacy policy using PolicyForge's list_policy_versions. Summarize what changed between the last two versions, and if the latest version dropped the section on data retention, restore the previous version with restore_policy_version.Build a pre-release compliance checklist habit
The highest-leverage move is making all of the above a habit. Add a step to your release checklist: the agent lists your policies, re-scans the codebase, checks freshness, audits for gaps, and regenerates anything that drifted — knowing that every policy's hosted URL updates in place, so nothing downstream breaks. Compliance stops being a yearly scramble and becomes part of shipping.
Run our pre-release compliance check. 1) List all our PolicyForge policies with list_policies. 2) Scan this repo for third-party services and data flows. 3) Run check_policy_freshness and audit_compliance on each policy. 4) If anything has drifted, regenerate the affected policy with regenerate_policy and confirm the hosted URLs are unchanged. Give me a summary I can paste into the release notes.Why This Beats Copy-Pasting a Template
A template privacy policy is a snapshot of a business that is not yours, frozen at the moment someone wrote it. The MCP workflow inverts that in three ways:
- Policies match the code. Your assistant scans the repo and feeds the real inventory of SDKs, data flows, and third-party services into generation — so the policy discloses what you actually do, not what a template assumes.
- Policies stay current. Freshness checks, audits, and in-place updates mean the document evolves with your stack, and the hosted URL your app links to never breaks.
- Policies are versioned. Every update and regeneration is snapshotted, so you can see what was published when — and roll back if an update goes wrong.
If you write code with an AI assistant, this is the natural way to handle legal pages too: generate them from the same context your assistant already has, and let the release checklist keep them honest. If you are not a developer — or you want the background on how MCP works before connecting anything — start with our plain-English MCP explainer.
Generate Legal Policies from Your Editor
Connect the PolicyForge MCP server to Claude Code, Cursor, or ChatGPT and try any of the 12 prompts above. Free tier includes 2 policies per month — no credit card required.