AI-native developer access

MCP integration for Codex, Claude, ChatGPT, and AI agents

Legal Policy Generator exposes a production Streamable HTTP MCP endpoint for agent-readable documentation, exact questionnaire inspection, deterministic validation, public-document retrieval, and authenticated account workflows.

Fastest setup

Give your agent one instruction

Copy this prompt and paste it into Codex, Claude Code, Google Antigravity, or another MCP-capable agent in your project. It connects the server for that client, signs you in, loads the exact questionnaire schema, validates every answer, and returns your private review link.

Set up and use the Legal Policy Generator MCP server to create my Privacy Policy or Terms of Service for this project, plus any other document I ask for below. Follow these steps in order and do not skip any.

Rules for the whole task:
- Only the Legal Policy Generator tools produce the documents. Never write policy or terms text yourself. When project integration is requested, use only the exact HTML or fragment returned by the tools; never reconstruct or rewrite legal content.
- Fill every answer yourself through the tools. Never send me to the web questionnaire to type answers.
- Never open the links the tools return and never use a browser or computer control; the links are only for me.
- If I ask for more than one document, for example a Privacy Policy and Terms of Service, complete every step for each one.
- If I ask to update an existing document, use this revision path instead of the new-document steps below: call list_documents to identify my owned policy_id, then start_document_revision. Use its existing answers as the starting point, change only facts I asked to change, call get_answer_schema and validate_document_answers until complete, preserve its returned presentation unless I requested a design change, offer the same customer design choices described below, then save_questionnaire_draft with the same draft_id. Give me the saved draft's review_url as a clickable link and wait for my approval. After I approve, call get_questionnaire_draft to preserve my latest saved design, then call finalize_document with that draft_id and confirm true, and give me the new version number and returned URLs. Never ask me to click Edit and regenerate or fill the questionnaire.
- Keep questions to me in one short message. Never ask for anything the tools, this repository, or my request already answer.

1. Check the connection
If you already have Legal Policy Generator tools, including get_answer_schema and create_privacy_policy or create_terms_of_service, possibly with a prefix such as mcp__legal_policy_generator__, go to step 3.

2. Connect the server
Endpoint: https://legalpolicygenerator.com/mcp
Server name: legal_policy_generator
Follow only the instruction for the client you are running in. If legal_policy_generator is already configured but its tools are missing, skip adding it and only complete sign-in. Run the commands yourself when you can; otherwise show me the exact command to run in a terminal.
- Codex CLI, IDE extension, or app: run `codex mcp add legal_policy_generator --url https://legalpolicygenerator.com/mcp`, then `codex mcp login legal_policy_generator`. If the login cannot finish inside your shell, ask me to run that command in my own terminal. Without the Codex CLI, add [mcp_servers.legal_policy_generator] with url = "https://legalpolicygenerator.com/mcp" to ~/.codex/config.toml and sign in from the MCP settings.
- Claude Code: run `claude mcp add --transport http --scope user legal_policy_generator https://legalpolicygenerator.com/mcp`. Then ask me to type /mcp, select legal_policy_generator, and choose Authenticate; if it is not listed yet, ask me to restart Claude Code first.
- Google Antigravity: open the agent panel menu, choose MCP Servers, Manage MCP Servers, View raw config (the file is ~/.gemini/config/mcp_config.json, which you may edit directly), and add this entry inside "mcpServers" without removing existing entries: "legal_policy_generator": {"command": "npx", "args": ["-y", "mcp-remote@latest", "https://legalpolicygenerator.com/mcp", "--transport", "http-only", "--auth-timeout", "300"]}. Node.js 18 or newer is required. On Windows, if npx does not start, use "command": "cmd" and put "/c", "npx" before the other args. Save, then refresh the MCP servers.
- Any other MCP client: add a remote Streamable HTTP server with URL https://legalpolicygenerator.com/mcp and OAuth sign-in. If the client supports only local stdio servers, use the command `npx -y mcp-remote@latest https://legalpolicygenerator.com/mcp --transport http-only --auth-timeout 300`.
Sign-in opens a browser page where I enter my email address and the 8-digit code sent to it. Never ask me for a password, API key, or access token, and never write a token into any file.
If the tools are still unavailable in this session after setup, tell me: "Restart this client or open a new chat, then paste the same prompt again." Then stop.

3. Load my saved details and the questionnaire
Create the document I ask for: Privacy Policy (document_type "privacy") or Terms of Service (document_type "terms"); if I did not say, ask me first. Call get_account_defaults first. It returns my saved operator identity and contact details from earlier documents; reuse them as answers. If it lists several operators, ask me once which one this project belongs to. Then call get_answer_schema with {"document_type": "privacy" or "terms"} for each document. Use only its field names and choice values, and respect required and visible_when. Answers are a JSON object that maps each field name to an array of strings, even for a single value, for example {"legal_name": ["Example Ltd"], "platforms": ["website"]}. Leave out fields that do not apply.

4. Fill the answers yourself
Fill every field from my request, get_account_defaults, and this repository: package manifests, environment examples, authentication, forms, cookies, analytics, advertising, email, accounts, user content, payments, subscriptions, storage, hosting region, third-party SDKs, and AI features. Use today's date as the effective date. By default also inspect the existing CSS variables, light and dark design tokens, fonts, framework theme configuration, and legal-page layout. Use get_answer_schema.presentation_schema to build a separate presentation object matching the project. Resolve existing colors to six-digit hex values, use supported sans or serif typography, and preserve its appearance preference. Choose format fragment if integrating into an existing legal page, standalone for customer-hosted HTML, or hosted for a managed link or app webview. If no theme evidence is available use the neutral modern preset; never invent customer brand colors. Treat the matched palette as a recommendation. If brand colors fail contrast validation, propose the closest readable colors and explain the adjustment for my choice. Reuse the same presentation across Privacy Policy and Terms for the same product. When I ask for minimal or defensive wording, choose the most protective option that stays true to what the product actually does, such as no sale or sharing, no advertising, and only the data the code really processes. Never invent a legal identity, address, contact detail, country, provider, or data practice that none of these sources supports. If a required fact is still unknown, ask me in one message and propose the most likely answer so I can simply confirm it. If a provider or practice you find is not among the allowed choices, tell me instead of substituting another value.

5. Validate
Call validate_document_answers with {"document_type": "privacy" or "terms", "answers": {...}, "presentation": {...}}. Fix every returned factual issue and presentation_issues by field yourself, and validate again until "complete" is true.

6. Create the private draft
Call create_privacy_policy or create_terms_of_service with {"answers": {...}, "presentation": {...}} and leave publish false. Create every document I requested before stopping. In your next reply, give me a separate clickable review_url for each draft, labeled Privacy Policy or Terms of Service, exactly as returned; explain that the review includes the actual customer design; do not open the links yourself. Recommend the palette found in the customer's product and identify the theme files or supplied colors it came from. Show the light and dark background, text, and accent colors, typography, appearance, and delivery format. Let the customer choose: keep the matched palette, use Modern, use Editorial, or customize colors. Accept the choice in chat or through the existing private review controls. For a chat change, validate the chosen presentation and call save_questionnaire_draft with the same draft_id and unchanged factual answers, then share its new review_url. Use the chosen palette for every requested document for that product unless the customer asks for different designs. Applying a preset means removing custom light, dark, and typography overrides so the preset takes effect. Keep an existing customer-selected design unless a change is requested. A design choice alone is not publication approval. Before finalizing, call get_questionnaire_draft and preserve the customer's latest saved presentation; never overwrite browser changes with an earlier recommendation. If I say a link does not work, call get_questionnaire_draft with its draft_id and give me the fresh review_url. After sharing every review link, check payment.required for each draft:
- false for all drafts: ask me in one short message which design I choose and whether to publish. If I already chose or approved the design, do not ask for the design choice again. Publication still requires my explicit approval.
- true for any draft: recommend the USD 5 monthly subscription, mention the one-time price in payment.one_time.hosted_total_usd, give me each required payment.purchase_url, and wait until I confirm payment.

7. Publish only after I approve
My asking you to publish counts as approval of the current saved design. Call get_questionnaire_draft first and keep its saved presentation. Call finalize_document with {"draft_id": "...", "confirm": true}. Give me public_url, html_url, pdf_url, fragment_url, and delivery_url exactly as returned. Explain which format matches my project. The public link opens the customer theme without generator logos, navigation, footer, or attribution. If I requested project integration, use only the returned artifact unchanged and follow integration_note; never regenerate legal prose yourself. If it says payment is still required, give me the returned link and wait.

Rules: share only URLs returned by the tools. If a tool asks for authorization, repeat the sign-in for your client. If a request is rate-limited, wait one minute and retry once. The generated document is automated wording, not legal advice.

You enter your email and the 8-digit sign-in code in your browser when asked. If your client needs a restart after setup, paste the same prompt again and the agent continues from the connection check.

What agents can do

Standard MCP instructions, prompts, resources, and tools help Codex, Claude, ChatGPT, IDE agents, and other compatible clients recognize Privacy Policy, privacy notice, Terms of Service, and Terms and Conditions tasks. Agents can inspect exact questionnaire steps, validate submitted answers, create private drafts or revisions of owned documents, return review links, and finalize only with server-confirmed entitlement.

Deterministic, not model-written

Agents help collect and submit facts. Repository-owned versioned clauses, server validation, pricing, ownership, entitlement, rendering, and publication remain authoritative. Runtime AI does not write legal clauses. Output is automated wording, not legal advice or a compliance guarantee.

Manual setup fallback

Use these only when your agent cannot configure its own client.

Codex commands

Codex adds the remote server and opens native OAuth account authorization. Codex app, CLI, and IDE clients on the same host share this MCP configuration.

codex mcp add legal_policy_generator --url https://legalpolicygenerator.com/mcp
codex mcp login legal_policy_generator

Configuration file alternative

Add this to ~/.codex/config.toml, then run codex mcp login legal_policy_generator and start a new session.

[mcp_servers.legal_policy_generator]
url = "https://legalpolicygenerator.com/mcp"
Claude Code command

Run the native command, start Claude Code, open /mcp, and choose Authenticate. Claude discovers the authorization server and opens the secure email-code flow. No client ID, secret, callback port, or bearer token is entered manually.

claude mcp add --transport http --scope user legal_policy_generator https://legalpolicygenerator.com/mcp
Google Antigravity configuration

Open the agent panel menu, choose MCP Servers, Manage MCP Servers, and View raw config. Add the entry below inside mcpServers, keep existing servers, save, and refresh. The bridge requires Node.js 18 or newer and opens the same browser sign-in.

{
  "mcpServers": {
    "legal_policy_generator": {"command": "npx", "args": ["-y", "mcp-remote@latest", "https://legalpolicygenerator.com/mcp", "--transport", "http-only", "--auth-timeout", "300"]}
  }
}
Other MCP clients

Add a remote Streamable HTTP server with URL https://legalpolicygenerator.com/mcp and OAuth sign-in. Clients that support only local stdio servers can run this bridge command.

npx -y mcp-remote@latest https://legalpolicygenerator.com/mcp --transport http-only --auth-timeout 300
ChatGPT on supported plugin surfaces

Where ChatGPT Work exposes developer mode and Plugins, enable developer mode in Settings, then register https://legalpolicygenerator.com/mcp in the Plugins interface. Workspace policy and product availability can control access. OAuth opens the same secure account authorization flow.

MCP endpoint: https://legalpolicygenerator.com/mcp. Agent index: llms.txt. Complete agent context: llms-full.txt.

Native account authorization

The MCP endpoint uses native OAuth 2.1 authorization. The client discovers authentication automatically, opens the secure account page, asks for the user's email, verifies the 8-digit one-time code, and stores and refreshes tokens in its own protected credential storage. Never ask the user to create, copy, paste, display, log, or commit a bearer token.

Recommended workflow

  1. Search or fetch current product documentation.
  2. Call get_answer_schema for exact field names, allowed values, and conditions.
  3. Validate complete answers and resolve every issue.
  4. Save an authenticated draft for browser review.
  5. Finalize only after explicit approval and server-confirmed entitlement.

Dedicated one-call document tools

Authenticated agents can call create_privacy_policy or create_terms_of_service with factual answers. Each tool creates an owned draft and returns entitlement state, exact price, and a direct website purchase link. The link carries a hashed-at-rest, one-use browser handoff valid for one hour. Opening it issues secure session cookies and immediately redirects to the clean review URL, so no session token appears in the URL. When the welcome offer is enabled, eligible accounts receive their first document free with hosting, advanced modules, HTML, and PDF. One offer covers both generators. For subsequent documents, agents recommend the $5 monthly subscription and offer the one-time price as an alternative. Active members continue without another payment request. Setting publish and confirm to true creates the immutable hosted document only after validation and entitlement checks succeed.

Protocol and security

Endpoint supports MCP protocol versions 2025-11-25, 2025-06-18, and 2025-03-26 over stateless JSON responses. OAuth 2.1 discovery, exact redirect matching, dynamic client registration, PKCE S256, single-use authorization codes, rotating refresh tokens, hashed credentials, origin checks, body limits, rate limits, UUID ownership, validation, and entitlement checks run on the server. Secrets and questionnaire bodies are excluded from logs.

MCP specification, Codex MCP documentation, and Claude Code MCP documentation define client behavior.

Boundary: Agents must never invent customer facts, legal applicability, processor use, payment status, or publication authority.