io.github.rushi053/privacypage-mcp

PrivacyPage MCP Server

Give your AI agent the power to generate privacy policies, terms of service, EULAs, cookie policies, and disclaimers — while it builds your app.

Powered by PrivacyPage. Free instant previews; unlock the full document for a one-time $9.99 (no subscription, no account).

Why

Every app shipped from Cursor, Lovable, Bolt, or v0 eventually needs legal documents — the App Store and Play Store require a privacy policy, GDPR requires cookie disclosures, and users expect terms of service. This MCP server lets the agent that's building your app generate those documents in the same conversation, filled in from what the agent already knows about your app: its name, platform, the data it collects, and the SDKs it uses.

Quick start

Requires Node.js 18+. No API key needed to generate previews.

Cursor

Add to ~/.cursor/mcp.json (or .cursor/mcp.json in your project):

{
  "mcpServers": {
    "privacypage": {
      "command": "npx",
      "args": ["-y", "privacypage-mcp"]
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "privacypage": {
      "command": "npx",
      "args": ["-y", "privacypage-mcp"]
    }
  }
}

Any MCP client (generic stdio config)

{
  "command": "npx",
  "args": ["-y", "privacypage-mcp"],
  "env": {
    "PRIVACYPAGE_LICENSE_KEY": "<optional — set after purchase to auto-unlock full documents>"
  }
}

Tools

Every generate_* tool returns a free 25-line preview, a documentId, and instructions for unlocking the full document.

Example agent conversation

You: Ship my fitness tracker app to the App Store. It uses Firebase Analytics and HealthKit.

Agent: The App Store requires a privacy policy. Let me generate one. (calls generate_privacy_policy with appName: "FitTrack", platform: "iOS", dataCollected: ["Health Data", "Usage Analytics"], thirdPartyServices: ["Google Analytics / Firebase"], childrenUnder13: false)

Agent: Here's a preview of your privacy policy — it covers HealthKit data, Firebase, GDPR and CCPA rights, and COPPA. To get the full document, purchase a one-time license at privacypage.io ($9.99, no subscription) and give me the key.

You: Here's my key: PP-XXXX-XXXX

Agent: (calls get_full_document) Done — I've saved the full policy to public/privacy-policy.md and linked it in your app's settings screen.

Pricing

• Preview: free. Every tool returns the first 25 lines of a real, fully generated document at no cost, no account needed.
• Full document: $9.99 one-time (or $24.99 for the all-documents bundle). No subscription, no recurring fees. Purchase at privacypage.io.
• After purchase, set PRIVACYPAGE_LICENSE_KEY in your MCP config and the agent can unlock full documents automatically.

Rate limit: 10 document generations per hour per IP. The server reports rate-limit errors to the agent with a friendly retry message.

Environment variables

Data handling

This server runs locally over stdio and makes HTTPS requests only to the PrivacyPage API (https://privacypage.io, or whatever PRIVACYPAGE_API_URL is set to). Everything below is verifiable in src/index.ts and src/api.ts.

What leaves your machine. Only the explicit arguments the agent passes to a tool call — the fields the generated document prints, such as app/site name, platform, company name, contact email, website URL, data-collection and cookie selections, key policies, and jurisdiction (varying by tool). For the generate_* tools these are sent as a plain JSON POST body; get_full_document sends the documentId and license key as query parameters on a GET request. No conversation context, no filesystem contents, and nothing else from the agent session is read or transmitted.

Schema-bounded. Each tool declares a fixed input schema, and every request payload is built field-by-field from those named arguments only. An agent has no channel to send extra context through these tools.

License key. PRIVACYPAGE_LICENSE_KEY (or the licenseKey argument) is sent only to the PrivacyPage API, solely to prove entitlement when fetching a full document.

What's stored server-side. The PrivacyPage service stores the generation inputs and the generated document — that's what lets a license key unlock a document by documentId after generation. This data is not used for analytics and is not shared. (Server-side behavior is a property of the privacypage.io service; this repository's source shows only what is sent.)

Rate limiting. Generation endpoints are limited to 10 document generations per hour per IP; the server reports 429 responses to the agent with a retry message.

Development

git clone https://github.com/rushi053/privacypage-mcp.git
cd privacypage-mcp
npm install
npm run build
npm run smoke-test          # handshake + tools/list over stdio
node scripts/smoke-test.mjs --call   # also makes one real API call

Disclaimer

Documents generated by PrivacyPage are professionally structured templates and AI-generated drafts. They are not legal advice; for high-stakes situations, have a lawyer review your documents.

License

MIT — the server. Generated documents are yours.