Questlaw Library

What questlaw-library MCP server does

The questlaw-library MCP server connects an MCP-compatible AI client to a QuestLaw research library exported as an encrypted .qlvault file. It provides read-only capabilities for searching the library and reading matching content. It does not modify the library, write an unencrypted copy to disk, or connect to a remote service.

The project is experimental, open source, and separate from the official QuestLaw product suite. It is intended for a library export rather than a live connection to QuestLaw. Research added after the export is unavailable until a newer backup is created.

How it works

Export a backup from the QuestLaw extension first. The resulting file normally follows the questlaw-backup-<date>.qlvault naming pattern. By default, the server searches ~/Downloads and uses the newest matching export, or it can use a path supplied through configuration.

At startup, the server obtains the account key from the operating system’s secret store, unwraps the vault key, and decrypts the export in memory. It then creates a search index and responds to MCP requests through stdio. The library is not stored unencrypted on disk, and the server itself makes no network connections.

The privacy boundary ends at the connected AI client: readable results are passed to that client, which may send them to its provider. Review the project’s security guidance before connecting a library containing sensitive material.

Setup and configuration

Node.js 20 or newer is required, with Node.js 24 or newer preferred. Run npx -y questlaw-mcp@0.5.1 setup to accept the disclosure, save the account key in the OS secret store, find and test-decrypt an export, and print client configuration. Run npx -y questlaw-mcp@0.5.1 doctor later to check the installation.

The account key is available in the QuestLaw extension under Settings, Encrypted library, and Show account key. macOS uses the login keychain, Windows uses a DPAPI-protected store, and Linux uses libsecret through secret-tool. The key can instead be supplied with QUESTLAW_RECOVERY_CODE, but only when QUESTLAW_ALLOW_ENV_KEY=1 is also set.

Set QUESTLAW_VAULT_FILE to a specific .qlvault file or another directory. Keep the account key protected because it can open every export from the library. Claude Desktop, Claude Code, and Codex have documented installation paths; ChatGPT requires OpenAI’s Secure MCP Tunnel because its desktop app cannot start a local MCP server directly.

Tools and capabilities

The questlaw-library MCP server exposes tools for two supported tasks:

• Searching the exported QuestLaw research library.
• Reading content from the library through the connected AI client.

These operations are read-only. The server does not provide documented write, editing, synchronization, or live-library features. Its input is the encrypted export, not Word documents or the live IndexedDB library.

Limitations and notes

The server only sees the state captured when the .qlvault file was exported. Daily backups in the QuestLaw extension can keep the available copy current, but the server still reads an export rather than the live library.

The project is not an official QuestLaw-supported product. The local process sends nothing over the network, but the connected AI client controls what happens to returned text. Word add-in documents are outside its scope, and using the server with Microsoft Copilot does not add access to those documents.

A compatible MCP client must be configured separately. ChatGPT ordinary chats need the Secure MCP Tunnel route, while the ChatGPT desktop app can use the Codex configuration only through its Codex functionality.