# Legal Policy Generator MCP integration for Codex, Claude, and ChatGPT

> Production Streamable HTTP MCP tools for Codex, Claude Code, supported ChatGPT Work plugin surfaces, IDE agents, and other MCP clients. Legal text remains deterministic and repository-owned; runtime AI does not write clauses.

## Endpoint

- MCP: https://legalpolicygenerator.com/mcp
- Protocol versions: 2025-11-25, 2025-06-18, 2025-03-26
- Transport: Streamable HTTP with stateless JSON responses
- Authentication: native MCP OAuth 2.1 with PKCE and dynamic client registration
- Discovery: standard MCP server instructions, prompts, resources, tool metadata, and official registry manifest

## Core tools

- `search`: Search product, pricing, questionnaire, limitation, MCP, and integration documentation.
- `fetch`: Fetch complete Markdown documentation.
- `get_questionnaire_step`: Inspect exact current questions and choices for Privacy Policy or Terms.
- `validate_document_answers`: Validate factual answers, contradictions, price, and section outline without storage.
- `read_public_document`: Read a published document by public UUID and optional immutable version.

## Account tools

- `create_privacy_policy`: Create an owned Privacy Policy draft in one call, or publish it with explicit confirmation and valid entitlement.
- `create_terms_of_service`: Create owned Terms of Service in one call with the same review and publication controls.
- `save_questionnaire_draft`: Create or replace an owned private draft.
- `get_questionnaire_draft`: Read owned draft answers and validation state.
- `list_documents`: List owned generated documents.
- `get_document`: Read owned content including unpublished versions.
- `finalize_document`: Create or regenerate an immutable version after explicit approval and server-authoritative entitlement.

## Native account authorization

The MCP endpoint uses native OAuth 2.1 authorization. The client discovers authentication automatically, opens the secure account page, asks for the user's email, verifies the 8-digit one-time code, and stores and refreshes tokens in its own protected credential storage. Never ask the user to create, copy, paste, display, log, or commit a bearer token.

## Codex installation

```sh
codex mcp add legal_policy_generator --url https://legalpolicygenerator.com/mcp
codex mcp login legal_policy_generator
```

Codex app, CLI, and IDE clients on the same host share MCP configuration. For manual configuration:

```toml
[mcp_servers.legal_policy_generator]
url = "https://legalpolicygenerator.com/mcp"
auth = "oauth"
default_tools_approval_mode = "writes"
tool_timeout_sec = 60
enabled = true
```

## Claude Code configuration

```sh
claude mcp add --transport http --scope user legal-policy-generator https://legalpolicygenerator.com/mcp
```

Start Claude Code, open `/mcp`, and choose Authenticate. Claude discovers OAuth metadata, dynamically registers its local callback, opens the browser email-code flow, and stores and refreshes credentials without manual client IDs, secrets, callback ports, or bearer tokens.

## ChatGPT on supported plugin surfaces

Where ChatGPT Work exposes developer mode and Plugins, enable developer mode in Settings, then register `https://legalpolicygenerator.com/mcp` in the Plugins interface. Workspace policy and product availability can control access.

## Required workflow

1. Search or fetch current documentation.
2. Inspect all relevant questionnaire steps.
3. Use only facts supplied by the user.
4. Validate answers and resolve every issue.
5. Save a private draft for browser review and inspect its verified payment state. The returned browser handoff URL is one-use, valid for one hour, establishes secure session cookies, and redirects to a clean URL without exposing a session token.
6. If membership or another entitlement is verified, do not ask for payment. Request publication approval and continue.
7. Otherwise recommend the USD 5 monthly subscription by default, provide the returned direct purchase URL, offer the exact one-time total as an alternative, and stop until website payment is verified.
8. Finalize only with explicit approval and server-confirmed entitlement.

## Security and legal boundary

Inputs are untrusted and bounded. OAuth discovery, exact redirect matching, dynamic registration, PKCE S256, one-time authorization codes, rotating refresh tokens, hashed credentials, origin checks, rate limits, UUID ownership, validation, pricing, entitlement, and publication rules are enforced by the server. Never invent customer facts, legal applicability, provider use, payment status, or publication authority. Generated wording is not legal advice or a guarantee of compliance, completeness, suitability, or enforceability.