About Checkbox
Checkbox is an MCP server for coding agents that assess subscription checkout and email flows against ROSCA and state automatic-renewal laws. It provides project setup, compliance plans, pre-deployment checks, and synthetic subscription tests; its output is an automated assessment, not legal advice.
Key features
- 01Set up compliance projects
- 02Generate and complete compliance plans
- 03Check checkout and email code
- 04Inspect pages and notice schedules
- 05Run synthetic test subscriptions
Use cases
- 01Assess a subscription checkout before release
- 02Check renewal notices in email flows
- 03Work through a state-law compliance plan
MCP support
Exposes Checkbox compliance API operations as tools to MCP clients. It supports remote Streamable HTTP with OAuth and local stdio; API-key authentication is also available.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://app.checkbox.site/mcpclaude mcp add --transport http site-checkbox-checkbox https://app.checkbox.site/mcp{"mcpServers":{"site-checkbox-checkbox":{"type":"http","url":"https://app.checkbox.site/mcp"}}}Open in Cursor{"servers":{"site-checkbox-checkbox":{"type":"http","url":"https://app.checkbox.site/mcp"}}}Open in VS Code{"mcpServers":{"site-checkbox-checkbox":{"type":"http","url":"https://app.checkbox.site/mcp"}}}{"mcpServers":{"site-checkbox-checkbox":{"serverUrl":"https://app.checkbox.site/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
https://app.checkbox.site/mcpAuth requiredTools
Details
From the project READMECheckbox MCP server
Subscription-law compliance for AI coding agents. Connect Claude, Cursor, VS Code or any MCP client to Checkbox and your agent can set up a project with one human click, check checkout code before it ships, work the compliance plan to done and run synthetic test subscriptions — against ROSCA, California's Automatic Renewal Law, New York GBL § 527-a and the other state automatic-renewal laws.
Docs: https://checkbox.site/docs/mcp · Agent index: https://checkbox.site/llms.txt · Free to start.
Connect
Remote (recommended) — Streamable HTTP at https://app.checkbox.site/mcp, nothing to install, no API key to copy:
the server implements MCP OAuth, so your client opens a Checkbox sign-in and you click Approve once.
- claude.ai / Claude Desktop: Settings → Connectors → Add custom connector →
https://app.checkbox.site/mcp→ Connect → Approve. - Claude Code:
claude mcp add --transport http checkbox https://app.checkbox.site/mcp, then/mcp→ Authenticate. - Cursor (
.cursor/mcp.json):{ "mcpServers": { "checkbox": { "url": "https://app.checkbox.site/mcp" } } }, then Connect.
API keys still work everywhere (CI, headless agents): add --header "Authorization: Bearer $CHECKBOX_SECRET_KEY"
(Claude Code) or "headers": { "Authorization": "Bearer ${env:CHECKBOX_SECRET_KEY}" } (Cursor). Agents without a
browser: https://app.checkbox.site/mcp?login=device offers setup_checkbox, which returns an approval link and then
test-mode keys.
Local (stdio) — for clients without remote MCP support:
{
"mcpServers": {
"checkbox": {
"command": "npx",
"args": ["-y", "@checkbox-site/mcp"],
"env": { "CHECKBOX_API_KEY": "ck_test_..." }
}
}
}
Package: @checkbox-site/mcp on npm (Node 20+; binary checkbox-mcp). Options:
--read-only, --api-key, --api-base; environment CHECKBOX_API_KEY (falls back to CHECKBOX_SECRET_KEY),
CHECKBOX_API_BASE, CHECKBOX_MCP_READ_ONLY=true.
Tools
Start with setup_checkbox; then get_compliance_plan → apply a task → verify_task, until the plan is compliant.
Preflight tools (check_disclosure, check_stripe_checkout_session, check_email, check_page_html,
get_notice_schedule) work on code before it is deployed. The full list, with the API operation behind each tool, is
at https://checkbox.site/docs/mcp#tools.
Every tool is a thin call to the public API (https://app.checkbox.site/v1), so keys, scopes, test/live mode and rate
limits are the API's. Write tools say so and carry readOnlyHint: false. Results are written for models and end with
the next tool to call.
Not legal advice
Checkbox output is an automated assessment against a legal catalog pending attorney review; it is not legal advice.
License
MIT
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.