PolicyForge/mcp

Generate legal policies — privacy policies, terms of service, cookie policies,
refund policies, EULAs, disclaimers, and HIPAA Business Associate Agreements —
directly from your AI coding tools (Claude Code, Cursor, Windsurf, Claude
Desktop) via the Model Context Protocol.
Ask your agent *"generate a GDPR + CCPA privacy policy for this app"* and it
fills the details from your codebase, calls PolicyForge, and drops the policy
straight into your project.
**Try it free:** compliance audits (audit_compliance), drift checks
(check_policy_freshness), and the scan rubric (get_disclosure_checklist)
are unlimited and never touch your quota — start with
*"audit our compliance — does the privacy policy cover everything this code
actually does?"*. And the first time your account connects through MCP it gets
**3 bonus policy generations** on top of the free 2/month — enough to generate
privacy, terms, and cookie policies for a new project in one conversation.
Connect
Pick the row that matches your client. If you're unsure, start with **A**.
| | How you sign in | Best for |
| --- | --- | --- |
| **A. Remote + OAuth** | Browser sign-in, no key to copy | Clients that support OAuth (Claude, ChatGPT) |
| **B. Remote + API key** | Authorization header | Any client that can send a header |
| **C. Local (npx)** | POLICYFORGE_API_KEY env var | Running the server as a local process |
All three expose the same tools. A and B need nothing installed.
A. Remote with OAuth (easiest)
No key to copy, no config file to edit. You'll need a PolicyForge account
first — , free, no card.
**1. Add the server.** The -s user makes it available in every project rather
than only the directory you ran this in:
Note there is no --header. Omitting it is what makes the client use OAuth.
**2. Restart your client.** MCP config is read at startup, so a session that
was already running won't see the new server.
**3. Authenticate.** Run /mcp, select policyforge, and press Enter:
Your browser opens, you sign in and approve, and the client stores the token
itself. You should land back at /mcp showing ✔ connected · 16 tools.
To confirm from the other side, a key named MCP · appears at
— that's the grant, and deleting it
revokes access.
Other clients differ in step 3: some prompt on first tool use rather than
offering an explicit authenticate action.
B. Remote with an API key
For clients that don't do OAuth yet. Create a key at
, then:
For clients with URL-based MCP config (Cursor, Windsurf, and others):
C. Local (npx)
Prefer a local process? The server runs via npx — nothing to install
globally. Uses an API key from the environment, which is what the MCP spec
recommends for stdio transports.
Claude Code
Cursor / Claude Desktop / Windsurf
Add to your MCP config (.cursor/mcp.json, claude_desktop_config.json, etc.):
> On Windows, some clients need the command wrapped: set "command": "cmd" and
> "args": ["/c", "npx", "-y", "@policyforge/mcp@latest"].
See for one-click installs (Cursor/VS Code) and
per-client instructions — with your API key pre-filled when signed in.
Troubleshooting
- **401** — if you connected with OAuth, the authorization was revoked or
expired: reconnect and approve again. If you used an API key, it was deleted,
disabled, or mistyped (keys start with pf_) — rotate or create one at
and restart the client.
- **402** — generation quota exhausted. Free tier: 2 generations per calendar
month, plus a one-time bonus of 3 extra generations on first MCP connect.
Only generate_policy/regenerate_policy consume quota — audits and drift
checks are free; ask your agent to run get_usage to see what's left.
- **429** — request rate limit (free tier: 10/minute, 100/day); the response
includes retry_after.
- **Server not listed in /mcp** — either the session started before you added