Connect PolicyForge to your AI coding tool. Your agent scans the codebase, PolicyForge generates policies that disclose what the app actually does — hosted, wired into your site, and kept current when the stack changes.
Free tier, no credit card — plus 3 bonus generations when you first connect via MCP.
The hosted endpoint needs no install and works from any MCP client — or run the npx package locally in your coding tool.
Replace pf_your_api_key_here with a key from your API dashboard (sign in to see it inlined here).
claude mcp add -s user --transport http policyforge https://policyforge.co/api/mcp/mcp, select policyforge, and press Enter. Your browser opens to approve the connection.The token is stored by your client — there's no key to copy. A key named MCP · your client appears in your dashboard; deleting it revokes access. Use the API-key form below if your client doesn't support OAuth yet.
claude mcp add --transport http policyforge https://policyforge.co/api/mcp --header "Authorization: Bearer pf_your_api_key_here"{
"mcpServers": {
"policyforge": {
"url": "https://policyforge.co/api/mcp",
"headers": {
"Authorization": "Bearer pf_your_api_key_here"
}
}
}
}Streamable HTTP at https://policyforge.co/api/mcp — same tools as the npx package, nothing to install or update, and it works from clients that can't run local processes. Prefer a local server? Use the per-client tabs.
Using ChatGPT? Custom MCP apps with full write actions are rolling out in beta for Business, Enterprise, and Edu workspaces — Plus users don't get the same install flow yet. Developers can use the remote endpoint above through the OpenAI Responses API today.
Audits are free and unlimited. audit_compliance, check_policy_freshness, and get_disclosure_checklist never touch your quota — ask your agent to audit the repo against your current policy as many times as you like, before you generate anything.
3 bonus generations on first connect. The first time your account calls PolicyForge through MCP, it gets 3 extra policy generations on top of the free 2/month — enough to generate the privacy policy, terms, and cookie policy for a new project in one conversation. Ask your agent to run get_usage to see it.
Policy questionnaires rely on what you remember about your stack. Your coding agent doesn't have to remember — it reads the source, and PolicyForge turns the findings into a compliant policy.
Your agent inspects dependencies, script tags, and cookie writes against our disclosure rubric.
Policies built from what the code actually does — hosted at a permanent URL.
The agent wires the policy into your footer — link or native embed.
Stack changed? Drift is detected, gaps audited, and the policy regenerates in place.
Scan this codebase and generate a privacy policy that matches what the app actually does, then add it to the site footer.No commands to memorize — describe the outcome and the tools do the rest.
> Audit our compliance — does the privacy policy cover everything this code actually does?
> Scan this codebase and generate a privacy policy that matches what the app actually does, then add it to the site footer.
> Has our privacy policy gone stale since the last release? Check it against the current code.
> We just added Stripe payments — update the privacy policy accordingly, keep the same URL.
generate_policyGenerate a policy from your app's real context — returns Markdown + a hosted URL.generate_baaGenerate a HIPAA Business Associate Agreement, validated against the 15 clauses 45 CFR 164.504(e) requires. Pro plan.regenerate_policyRe-run the AI engine with changed context. Same ID and hosted URL, previous version saved.update_policyHand-edit a policy in place — published links keep working.list_policy_versionsVersion history — snapshots before every update, regeneration, or restore.restore_policy_versionRoll back to any previous version (itself reversible).delete_policyPermanently delete a policy.get_disclosure_checklistThe scan rubric: which SDKs and patterns legally require disclosure.audit_complianceCompare what your code does with what your policy discloses. Gap report with severities.check_policy_freshnessDrift detection: diff the current codebase scan against the stored stack manifest.get_integration_guideCopy-paste embed or link instructions for Next.js, React, HTML, WordPress.list_policiesList the policies on your account.get_policyFetch a policy with status, hosted URL, and full content.get_usageCheck your tier and remaining generation quota.list_policy_typesSupported policy types, business types, and jurisdictions.It's a thin client over the same authenticated REST API as your dashboard — no separate storage, no separate permissions. Revoking the API key, or the OAuth authorization, kills all access instantly.
Pass POLICYFORGE_API_KEY as an env var (or the ${POLICYFORGE_API_KEY} placeholder in a committed .mcp.json) — never commit a key. Create and revoke keys anytime in the API dashboard.
delete_policy and content overwrites carry MCP destructive annotations, so well-behaved clients ask before running them — and every update or regeneration snapshots the previous version first, so overwrites are reversible.
Quota and rate limits are enforced server-side per key. A runaway agent can't do anything your API key couldn't.
Prompt injection is the LLM-specific risk: content from other tools in your agent's context could try to trigger PolicyForge actions. Keep human confirmation on for destructive tools and only run MCP servers you trust alongside it.
If you connected with OAuth, the authorization was revoked or expired — reconnect and approve again. If you used an API key, it was deleted, disabled, or mistyped. Keys start with pf_ — check yours in the API dashboard, and remember that rotating a key invalidates any config still holding the old one. Paste the new key into your MCP config and restart the client.
Policy generation is metered: the free tier includes 2 generations per calendar month, plus a one-time bonus of 3 extra generations the first time you connect via MCP. Only generate_policy and regenerate_policy consume quota — audits, drift checks, and reads are free and unlimited. Ask your agent to run get_usage to see exactly what's left, or upgrade for unlimited generation.
Request limits are per key (free tier: 10/minute, 100/day). The response includes a retry_after — well-behaved agents back off automatically. Persistent 429s usually mean a looping agent; check what it's doing.
Two causes. Either the session started before you added the server — MCP config is read at startup, so restart the client. Or it was added to a single project's scope: `claude mcp add -s user …` registers it for every directory. Adding a server does not connect it; run /mcp and select it to authenticate.
Most clients only load MCP servers at startup — restart after editing the config. On Windows, npx-based configs need the cmd wrapper shown in the install snippets. In Claude Code, `claude mcp list` shows whether the server connected.
Seen on the consent screen when a client uses a callback URL we can't match. Loopback callbacks are accepted on any port, as RFC 8252 requires for native apps, so this should be rare — report the exact URI and it can be supported.
generate_policy and regenerate_policy run a full AI generation server-side and can take a minute or two. The server allows up to 3 minutes — if your client gives up sooner, raise its MCP tool timeout.
co.policyforge/mcp. The server holds no data — every call runs through the same authenticated API as the dashboard.