Claude CodeCursorWindsurfVS Code

    Legal policies thatmatch your code

    Connect PolicyForge to your AI coding tool. Your agent scans the codebase, generates policies that disclose what the app actually does, wires them into your site, and keeps them current when the stack changes.

    Connect in seconds

    The hosted endpoint needs no install and works from any MCP client — or run the npx package locally in your coding tool.

    Replace pf_your_api_key_here with a key from your API dashboard (sign in to see it inlined here).

    Claude Code — connect straight to the hosted endpoint
    claude mcp add --transport http policyforge https://policyforge.co/api/mcp --header "Authorization: Bearer pf_your_api_key_here"
    Clients with URL-based MCP config (Cursor, Windsurf, and others)
    {
      "mcpServers": {
        "policyforge": {
          "url": "https://policyforge.co/api/mcp",
          "headers": {
            "Authorization": "Bearer pf_your_api_key_here"
          }
        }
      }
    }

    Streamable HTTP at https://policyforge.co/api/mcp — same tools as the npx package, nothing to install or update, and it works from clients that can't run local processes. Prefer a local server? Use the per-client tabs.

    No local install — connect straight to the hosted endpoint
    claude mcp add --transport http policyforge https://policyforge.co/api/mcp --header "Authorization: Bearer pf_your_api_key_here"

    Streamable HTTP at https://policyforge.co/api/mcp. Same tools as the npx package.

    Questionnaires ask you. Your agent reads the code.

    Competitor questionnaires rely on what you remember about your stack. Your coding agent doesn't have to remember — it reads the source.

    Scan

    Your agent inspects dependencies, script tags, and cookie writes against our disclosure rubric.

    Generate

    Policies built from what the code actually does — hosted at a permanent URL.

    Integrate

    The agent wires the policy into your footer — link or native embed.

    Stay current

    Stack changed? Drift is detected, gaps audited, and the policy regenerates in place.

    Then just ask your agent:
    > Scan this codebase and generate a privacy policy that matches what the app actually does, then add it to the site footer.

    Things to ask your agent

    No commands to memorize — describe the outcome and the tools do the rest.

    First policy

    > Scan this codebase and generate a privacy policy that matches what the app actually does, then add it to the site footer.

    Compliance audit

    > Audit our compliance — does the privacy policy cover everything this code actually does?

    Stack changed

    > We just added Stripe payments — update the privacy policy accordingly, keep the same URL.

    Drift check

    > Has our privacy policy gone stale since the last release? Check it against the current code.

    14 tools

    v0.4

    Generate & maintain

    generate_policyGenerate a policy from your app's real context — returns Markdown + a hosted URL.
    regenerate_policyRe-run the AI engine with changed context. Same ID and hosted URL, previous version saved.
    update_policyHand-edit a policy in place — published links keep working.
    list_policy_versionsVersion history — snapshots before every update, regeneration, or restore.
    restore_policy_versionRoll back to any previous version (itself reversible).
    delete_policyPermanently delete a policy.

    Audit & monitor

    get_disclosure_checklistThe scan rubric: which SDKs and patterns legally require disclosure.
    audit_complianceCompare what your code does with what your policy discloses. Gap report with severities.
    check_policy_freshnessDrift detection: diff the current codebase scan against the stored stack manifest.

    Integrate

    get_integration_guideCopy-paste embed or link instructions for Next.js, React, HTML, WordPress.

    Account & discovery

    list_policiesList the policies on your account.
    get_policyFetch a policy with status, hosted URL, and full content.
    get_usageCheck your tier and remaining generation quota.
    list_policy_typesSupported policy types, business types, and jurisdictions.

    Security model

    • The server holds no data

      It's a thin client over the same authenticated REST API as your dashboard — no separate storage, no separate permissions. Revoking the API key kills all access instantly.

    • Keys stay in your environment

      Pass POLICYFORGE_API_KEY as an env var (or the ${POLICYFORGE_API_KEY} placeholder in a committed .mcp.json) — never commit a key. Create and revoke keys anytime in the API dashboard.

    • Destructive actions are flagged

      delete_policy and content overwrites carry MCP destructive annotations, so well-behaved clients ask before running them — and every update or regeneration snapshots the previous version first, so overwrites are reversible.

    • Same limits as the API

      Quota and rate limits are enforced server-side per key. A runaway agent can't do anything your API key couldn't.

    • Watch what else is connected

      Prompt injection is the LLM-specific risk: content from other tools in your agent's context could try to trigger PolicyForge actions. Keep human confirmation on for destructive tools and only run MCP servers you trust alongside it.

    Troubleshooting

    401 Unauthorized

    The key was deleted, disabled, or mistyped. Keys start with pf_ — check yours in the API dashboard, and remember that rotating a key invalidates any config still holding the old one. Paste the new key into your MCP config and restart the client.

    402 Quota exhausted

    Policy generation is metered: the free tier includes 2 generations per calendar month (with a daily cap), resetting monthly. Only generate_policy and regenerate_policy consume quota — audits, drift checks, and reads are free. Ask your agent to run get_usage to see exactly what's left, or upgrade for unlimited generation.

    429 Rate limited

    Request limits are per key (free tier: 10/minute, 100/day). The response includes a retry_after — well-behaved agents back off automatically. Persistent 429s usually mean a looping agent; check what it's doing.

    Tools don't show up in the client

    Most clients only load MCP servers at startup — restart after editing the config. On Windows, npx-based configs need the cmd wrapper shown in the install snippets. In Claude Code, `claude mcp list` shows whether the server connected.

    Generation times out

    generate_policy and regenerate_policy run a full AI generation server-side and can take a minute or two. The server allows up to 3 minutes — if your client gives up sooner, raise its MCP tool timeout.

    Listed in the official MCP Registry as co.policyforge/mcp. The server holds no data — every call runs through the same authenticated API as the dashboard.