Policyforge MCP server

PolicyForge MCP Server

Generate legal policies — privacy policies, terms of service, cookie policies, refund policies, EULAs, disclaimers, and HIPAA Business Associate Agreements — directly from your AI coding tools (Claude Code, Cursor, Windsurf, Claude Desktop) via the Model Context Protocol.

Ask your agent "generate a GDPR + CCPA privacy policy for this app" and it fills the details from your codebase, calls PolicyForge, and drops the policy straight into your project.

Try it free: compliance audits (auditcompliance), drift checks (checkpolicyfreshness), and the scan rubric (getdisclosurechecklist) are unlimited and never touch your quota — start with "audit our compliance — does the privacy policy cover everything this code actually does?". And the first time your account connects through MCP it gets 3 bonus policy generations** on top of the free 2/month — enough to generate privacy, terms, and cookie policies for a new project in one conversation.

Connect

Pick the row that matches your client. If you're unsure, start with A.

All three expose the same tools. A and B need nothing installed.

A. Remote with OAuth (easiest)

No key to copy, no config file to edit. You'll need a PolicyForge account first — , free, no card.

1. Add the server. The -s user makes it available in every project rather than only the directory you ran this in:

claude mcp add -s user --transport http policyforge https://policyforge.co/api/mcp

Note there is no --header. Omitting it is what makes the client use OAuth.

2. Restart your client. MCP config is read at startup, so a session that was already running won't see the new server.

3. Authenticate. Run /mcp, select policyforge, and press Enter:

policyforge · △ needs authentication

Your browser opens, you sign in and approve, and the client stores the token itself. You should land back at /mcp showing ✔ connected · 15 tools.

To confirm from the other side, a key named MCP · appears at — that's the grant, and deleting it revokes access.

Other clients differ in step 3: some prompt on first tool use rather than offering an explicit authenticate action.

B. Remote with an API key

For clients that don't do OAuth yet. Create a key at , then:

claude mcp add --transport http policyforge https://policyforge.co/api/mcp \
  --header "Authorization: Bearer pf_your_key_here"

For clients with URL-based MCP config (Cursor, Windsurf, and others):

{
  "mcpServers": {
    "policyforge": {
      "url": "https://policyforge.co/api/mcp",
      "headers": { "Authorization": "Bearer pf_your_key_here" }
    }
  }
}

C. Local (npx)

Prefer a local process? The server runs via npx — nothing to install globally. Uses an API key from the environment, which is what the MCP spec recommends for stdio transports.

Claude Code

claude mcp add policyforge \
  --env POLICYFORGE_API_KEY=your_key_here \
  -- npx -y @policyforge/mcp@latest

Cursor / Claude Desktop / Windsurf

Add to your MCP config (.cursor/mcp.json, claudedesktopconfig.json, etc.):

{
  "mcpServers": {
    "policyforge": {
      "command": "npx",
      "args": ["-y", "@policyforge/mcp@latest"],
      "env": {
        "POLICYFORGE_API_KEY": "your_key_here"
      }
    }
  }
}

On Windows, some clients need the command wrapped: set "command": "cmd" and

"args": ["/c", "npx", "-y", "@policyforge/mcp@latest"].

Shortened. The full README is on GitHub.