PolicyForge MCP Server

What PolicyForge MCP Server MCP server does

PolicyForge MCP Server MCP server gives MCP-compatible coding tools access to PolicyForge policy generation and management. It can create privacy policies, terms of service, cookie policies, refund policies, EULAs, and disclaimers using business details, jurisdiction, and information discovered in a project. A separate tool creates HIPAA Business Associate Agreements between a covered entity and a vendor handling protected health information; that tool is available on the Pro plan and does not publish the agreement publicly.

The service also provides operational checks around an existing policy. Compliance auditing compares a scanned code manifest with the disclosures in a policy, while freshness checking compares a current scan with the manifest saved when the policy was generated. This makes the server relevant for teams that need to review policy coverage after application changes rather than generating documents only once.

How it works

A typical workflow begins with get_disclosure_checklist. The agent uses the rubric to inspect dependencies, script tags, cookie writes, and outbound hosts, then builds a stack manifest. That context is sent to generate_policy along with the policy type, business type, jurisdiction, company name, and contact email. The manifest is retained for later drift checks.

Generation returns Markdown and a hosted URL. If a request remains in progress, check_generation retrieves the result using its job ID; generation can take 40–60 seconds, while tools wait up to 45 seconds. regenerate_policy can rerun generation with changed context without changing the policy ID or hosted URL. update_policy supports find-and-replace edits or replacement of the full content.

Before updates, regenerations, and restores, the service saves a snapshot. list_policy_versions shows that history, and restore_policy_version can return a policy to an earlier state. The restore operation is itself reversible.

Setup and configuration

PolicyForge MCP Server MCP server supports three connection patterns. Remote OAuth uses https://policyforge.co/api/mcp and lets the client handle sign-in. Remote API-key access uses the same endpoint with an Authorization: Bearer ... header. Local stdio access runs the package with npx -y @policyforge/mcp@latest and supplies POLICYFORGE_API_KEY in the environment.

The README documents setup for Claude Code, Cursor, Claude Desktop, and Windsurf. Configuration changes require restarting the client. Windows users may need to run npx through cmd with /c. An account is required; the README identifies PolicyForge accounts and API keys as the authentication methods.

Tools and capabilities

The tool set covers:

• Generating and regenerating policies, including hosted URLs.
• Creating a clause-validated HIPAA BAA for Pro users.
• Auditing disclosures against scanned application behavior.
• Detecting codebase drift against the original generation manifest.
• Listing, fetching, editing, versioning, restoring, and deleting policies.
• Checking account tier and remaining generation quota.
• Retrieving disclosure guidance, embed instructions, and supported policy types, business types, and jurisdictions.

get_integration_guide provides embed or link instructions for Next.js, React, plain HTML, and WordPress. list_policies supports type and status filters with pagination.

Limitations and notes

Policy generation consumes quota. The free tier provides two generations per calendar month plus a one-time three-generation bonus on the first MCP connection, according to the README. generate_policy and regenerate_policy consume quota, while compliance audits, freshness checks, and the disclosure checklist do not. The BAA tool is restricted to the Pro plan.

Deleting a policy is permanent and makes its hosted URL stop working. A 401 response indicates an authentication problem, a 402 indicates exhausted generation quota, and a 429 indicates rate limiting. The documented free-tier rate limit is 10 requests per minute and 100 per day. Policy output depends on the business context and code scan supplied to the service, so the generated material should be reviewed for project-specific accuracy.