Generate a legal policy (privacy policy, terms of service, cookie policy, refund policy, EULA, or disclaimer) for a business and return its Markdown content plus a hosted URL. Consumes one policy from the account's quota. IMPORTANT: if you are working inside the user's project, call get_disclosure_checklist and scan the codebase FIRST (dependencies, script tags, cookie writes, outbound hosts), then fill the optional fields below from what the code actually does — do not ask the user for facts you can read from source. Only ask for what code cannot tell you: legal company name, contact email, physical address, governing law. For terms_of_service, eula and disclaimer, always ask for governing_law: without it (or a physical address to infer it from) the document contains a marker to fill in. The result lists claims to verify: specific statements about third parties, certifications or deadlines that your inputs did not supply. Show them to the user and fix them with update_policy before publishing. Generation takes 40-60 seconds; if it is not finished within about 45 seconds this returns a job ID instead, and check_generation fetches the result. Never call generate_policy again for the same policy while a job is running.
Generate a HIPAA Business Associate Agreement (BAA) between a covered entity and a vendor that handles Protected Health Information. Built from the clauses required by 45 CFR 164.504(e) and validated clause by clause before it is returned.
Use this instead of generate_policy for BAAs — a BAA is a binding two-party contract, not a published policy, so it needs both parties' legal names and addresses and is never hosted at a public URL.
Ask the user for the party details, effective date, and governing law: these are negotiated facts you cannot read from source code. Requires a Pro plan. The result is a draft for counsel to review, not executed legal advice. If it is not finished within about 45 seconds this returns a job ID; use check_generation for the result.
List the policies previously created on this PolicyForge account, newest first.
Retrieve a single policy by ID, including its status, hosted URL, and full Markdown content.
Get the result of a generate_policy, generate_baa or regenerate_policy call that was still running when it returned a job ID. Returns the finished policy, the error if generation failed, or says it is still running. Use this instead of starting the generation again, which would create a duplicate.
Update an existing policy in place — the policy ID, hosted URL, and embed keep working, so links already published on the user's site stay valid. Use this instead of generate_policy when the business context changed (new SDK, new data flow, renamed company): fetch the current content with get_policy, then either send small changes as `edits` (exact find/replace pairs, best for one-line fixes) or submit the complete revised Markdown as `content`. The previous content is saved as a version first, so restore_policy_version can undo a bad update.
Re-run the AI generation engine over a policy's stored business context merged with the changed fields you provide — same policy ID and hosted URL, so published links keep working. The previous content is saved as a version first (see list_policy_versions / restore_policy_version). Consumes one generation from quota, like generate_policy. Use this when the business context changed substantially (new integrations, new jurisdiction, renamed company); for small wording fixes prefer update_policy, which is free and instant. If it is not finished within about 45 seconds this returns a job ID; use check_generation for the result.
Compliance gap analysis: submit the stack manifest you built by scanning the codebase (see get_disclosure_checklist), optionally with a policy_id to audit against. PolicyForge compares what the code does with what the policy discloses and returns missing disclosures, overstated claims, missing policy types, and recommendations. Without a policy_id it audits the manifest alone (which policies are needed and what they must cover). Does not consume generation quota.
Drift detection: scan the codebase now (get_disclosure_checklist), build the current stack manifest, and compare it against the manifest stored when the policy was last generated/regenerated. Reports what changed in the stack so you know whether the policy still matches the code. Runs locally on the two manifests — no AI call, no quota.
Version history for a policy: snapshots taken before every API update, regeneration, or restore, plus any auto-generated compliance update drafts. Use get-version content via restore_policy_version, or fetch a single version's content with this policy's versions endpoint.
Restore a policy to a previous version from list_policy_versions. The current content is snapshotted as a new version first, so a restore is itself reversible. The hosted URL is unchanged.
Permanently delete a policy. The hosted URL and any embeds of it stop working immediately, and this cannot be undone. Confirm with the user before deleting anything they may have linked from their site.
+4 more tools listed on main page