Connect PolicyForge to your AI coding tool. Your agent scans the codebase, generates policies that disclose what the app actually does, wires them into your site, and keeps them current when the stack changes.
The hosted endpoint needs no install and works from any MCP client — or run the npx package locally in your coding tool.
Replace pf_your_api_key_here with a key from your API dashboard (sign in to see it inlined here).
claude mcp add --transport http policyforge https://policyforge.co/api/mcp --header "Authorization: Bearer pf_your_api_key_here"{
"mcpServers": {
"policyforge": {
"url": "https://policyforge.co/api/mcp",
"headers": {
"Authorization": "Bearer pf_your_api_key_here"
}
}
}
}Streamable HTTP at https://policyforge.co/api/mcp — same tools as the npx package, nothing to install or update, and it works from clients that can't run local processes. Prefer a local server? Use the per-client tabs.
claude mcp add --transport http policyforge https://policyforge.co/api/mcp --header "Authorization: Bearer pf_your_api_key_here"Streamable HTTP at https://policyforge.co/api/mcp. Same tools as the npx package.
Competitor questionnaires rely on what you remember about your stack. Your coding agent doesn't have to remember — it reads the source.
Your agent inspects dependencies, script tags, and cookie writes against our disclosure rubric.
Policies built from what the code actually does — hosted at a permanent URL.
The agent wires the policy into your footer — link or native embed.
Stack changed? Drift is detected, gaps audited, and the policy regenerates in place.
> Scan this codebase and generate a privacy policy that matches what the app actually does, then add it to the site footer.No commands to memorize — describe the outcome and the tools do the rest.
> Scan this codebase and generate a privacy policy that matches what the app actually does, then add it to the site footer.
> Audit our compliance — does the privacy policy cover everything this code actually does?
> We just added Stripe payments — update the privacy policy accordingly, keep the same URL.
> Has our privacy policy gone stale since the last release? Check it against the current code.
generate_policyGenerate a policy from your app's real context — returns Markdown + a hosted URL.regenerate_policyRe-run the AI engine with changed context. Same ID and hosted URL, previous version saved.update_policyHand-edit a policy in place — published links keep working.list_policy_versionsVersion history — snapshots before every update, regeneration, or restore.restore_policy_versionRoll back to any previous version (itself reversible).delete_policyPermanently delete a policy.get_disclosure_checklistThe scan rubric: which SDKs and patterns legally require disclosure.audit_complianceCompare what your code does with what your policy discloses. Gap report with severities.check_policy_freshnessDrift detection: diff the current codebase scan against the stored stack manifest.get_integration_guideCopy-paste embed or link instructions for Next.js, React, HTML, WordPress.list_policiesList the policies on your account.get_policyFetch a policy with status, hosted URL, and full content.get_usageCheck your tier and remaining generation quota.list_policy_typesSupported policy types, business types, and jurisdictions.It's a thin client over the same authenticated REST API as your dashboard — no separate storage, no separate permissions. Revoking the API key kills all access instantly.
Pass POLICYFORGE_API_KEY as an env var (or the ${POLICYFORGE_API_KEY} placeholder in a committed .mcp.json) — never commit a key. Create and revoke keys anytime in the API dashboard.
delete_policy and content overwrites carry MCP destructive annotations, so well-behaved clients ask before running them — and every update or regeneration snapshots the previous version first, so overwrites are reversible.
Quota and rate limits are enforced server-side per key. A runaway agent can't do anything your API key couldn't.
Prompt injection is the LLM-specific risk: content from other tools in your agent's context could try to trigger PolicyForge actions. Keep human confirmation on for destructive tools and only run MCP servers you trust alongside it.
The key was deleted, disabled, or mistyped. Keys start with pf_ — check yours in the API dashboard, and remember that rotating a key invalidates any config still holding the old one. Paste the new key into your MCP config and restart the client.
Policy generation is metered: the free tier includes 2 generations per calendar month (with a daily cap), resetting monthly. Only generate_policy and regenerate_policy consume quota — audits, drift checks, and reads are free. Ask your agent to run get_usage to see exactly what's left, or upgrade for unlimited generation.
Request limits are per key (free tier: 10/minute, 100/day). The response includes a retry_after — well-behaved agents back off automatically. Persistent 429s usually mean a looping agent; check what it's doing.
Most clients only load MCP servers at startup — restart after editing the config. On Windows, npx-based configs need the cmd wrapper shown in the install snippets. In Claude Code, `claude mcp list` shows whether the server connected.
generate_policy and regenerate_policy run a full AI generation server-side and can take a minute or two. The server allows up to 3 minutes — if your client gives up sooner, raise its MCP tool timeout.
co.policyforge/mcp. The server holds no data — every call runs through the same authenticated API as the dashboard.