Hosted privacy policy URLs for apps, sites, stores and lead forms, created by an agent in one call
Scored across 6 tools
The two 'check_' tools could superficially be confused (one verifies a URL is live, the other audits page content for A2P 10DLC carrier rules), and the two 'generate_' tools both target Apple privacy artifacts. Descriptions draw clear lines between liveness, carrier compliance, privacy manifest plist, and store data-safety labels, so misselection risk is low but not zero.
Every tool follows a consistent snake_case verb_noun pattern (check_*, create_*, generate_*, list_*) with no style mixing. The one numeric token in check_a2p_10dlc_documents reflects domain terminology rather than a convention break.
Six tools is well-scoped for a privacy-policy hosting and compliance service: create, verify, enumerate valid inputs, plus three distinct compliance generators. Each tool has a distinct job and none looks like filler.
Core lifecycle is covered: create a hosted policy, check that it is live (including after a pending payment), and validate it against carrier requirements, plus the two Apple/store compliance generators and a resource-type lookup. Gaps are the absence of update/delete/retrieve-content operations on an existing hosted policy, which an agent must work around by creating anew.
Opens a business's privacy policy, SMS terms and opt-in page (public https links) and checks what US carrier reviewers look for before approving an A2P 10DLC texting campaign: the non-sharing statement and no wording that lets mobile data go to third parties (Twilio 30908, 30932), frequency, "Message and data rates may apply", STOP and HELP in the terms, and an opt-in that is never pre-ticked (30924). Returns verdict and pass/warn/fail checks per page. Pattern checks, not a carrier's decision; nothing is stored.
Inputs: privacyUrl (required), optInUrl, termsUrl.
Confirm whether a hosted privacy policy is live. Returns status (active or not_found), liveUrl, and updatedAt when live.
Inputs: companySlug (required).
Generate and host a privacy policy for a business, app, store or site and return its stable HTTPS URL. Free resource types and Agent API key holders get liveUrl at once; other types get a Stripe Checkout link ($49/year) for a human to pay, plus the pendingUrl that goes live after payment. Repeating a call with the same inputs (or the same idempotencyKey) within 24 hours returns the first result.
Inputs: email (required), companyName (required), resourceType (required), ccpa, +5 more.
Apple privacy manifest for the app's own code: the data the app itself collects (ownData ids), its own tracking (with tracking domains), the required-reason APIs its code uses with Apple's reason codes, and optionally SDKs linked statically without their own manifest. SDKs with their own manifest are covered by theirs (Apple). Categories: NSPrivacyAccessedAPICategoryFileTimestamp (DDA9.1, C617.1, 3B52.1); NSPrivacyAccessedAPICategorySystemBootTime (35F9.1, 8FFB.1, 3D61.1); NSPrivacyAccessedAPICategoryDiskSpace (85F4.1, E174.1, 7D9E.1, B728.1); NSPrivacyAccessedAPICategoryActiveKeyboards (3EC4.1, 54BD.1); NSPrivacyAccessedAPICategoryUserDefaults (CA92.1, 1C8F.1, AC6B.1). Returns plist (XML), manifest (the same as JSON) and problems (empty when App Store Connect should accept it).
Inputs: ownData, settings, tracking, apiReasons, +1 more.
Answers for Apple's App Privacy details and Google Play's Data safety form from the SDKs an app uses, their settings and the data the app collects itself. Every answer carries the vendor or store page it comes from. Settings are yes/no questions per SDK (ids like ga.user_id, app.iap); unknown ids are rejected. SDK ids: firebase-analytics, firebase-crashlytics, firebase-auth, firebase-messaging, admob, meta, revenuecat, onesignal, sentry, stripe, mixpanel, amplitude, google-sign-in, sign-in-with-apple, appsflyer. Returns wizardUrl, a privacy-policy wizard link with the same services and personal data filled in. A starting point to check, not legal advice.
Inputs: sdks (required), platforms (required), ownData, settings, +2 more.
The resourceType values create_privacy_policy_url accepts, and which of them are hosted free. No side effects.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Privacy requests (DSARs) for every site you run: triage, app look-ups, tasks and the audit trail.
Pay-per-call agent infrastructure: file storage & handoff, compute tools, messaging, e-sign, KYC.
Create private creator, business and agent pages. Use guides, prompts, previews and owner approval.
One-step legal compliance for vibe-coded apps: privacy, terms, cookie banner and EU AI Act check.
Add one secure layer between your agents and this server.
