North End Law

Open a matter

open_matter

Starts a request for a data processing agreement ($350) or, with tool "baa", a business associate agreement ($350). Send only the service, the governing law (CALIFORNIA by default, or SPAIN; CALIFORNIA only for a BAA), the client's role (PROCESSOR by default, or CONTROLLER; BUSINESS_ASSOCIATE for a BAA, with receivesPhi false) and, if useful, a short label that names no one. Do not ask the user for, and do not send, any name, e-mail address or postal address: the firm never needs them from you. Write "the Client" for the user's company and "the Customer" (or "the Vendor", when the client is the controller) for the other party. Returns a matter id, a matter token (shown once: keep it) and a private link. Give the private link to the user and ask them to open it in their browser within 24 hours. There the user enters their company's details, their own and the other party's, and the firm runs its conflicts check. You never see those details. The firm accepts the engagement when its automatic conflicts check is clear and payment is received (for a subscriber, when the engagement is accepted and the check is clear). If a possible conflict is found, nothing is charged, or the payment is refunded in full. A vendor whose services handle protected health information should use request_consultation.

Input Schema

Name	Required	Description	Default
`role`	No	The client's role under the agreement: PROCESSOR by default, or CONTROLLER. For a BAA: BUSINESS_ASSOCIATE (the default and the only role offered).
`tool`	Yes	The service: "dpa" (data processing agreement) or "baa" (business associate agreement).
`label`	No	Optional. A short label for the user to recognize the request, for example "customer DPA, October". It must name no one.
`receivesPhi`	No	BAA only, and required for it: whether the client's services are designed to create, receive, maintain or transmit protected health information. Only false is accepted; for services that handle it, use request_consultation.
`governingLaw`	No	The law of the DPA: CALIFORNIA by default, or SPAIN. The law of the BAA: CALIFORNIA only.	CALIFORNIA

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 24, 2026
- removedInput schema / additionalProperties
```
Removed value: -false
```

Changed6 schema fields changedOct 13, 2026

removedInput schema / properties / adverseParties

Removed value: -{
-  "anyOf": [
-    {
-      "const": "none",
-      "type": "string"
-    },
-    {
-      "items": {
-        "$ref": "#/properties/namedPerson/properties/name"
-      },
-      "maxItems": 10,
-      "minItems": 1,
-      "type": "array"
-    }
-  ],
-  "description": "Anyone whose interests are adverse to the client in this matter, or \"none\"."
-}

removedInput schema / properties / client

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "entityType": {
-      "description": "For example \"Delaware corporation\" or \"sociedad limitada\".",
-      "maxLength": 100,
-      "minLength": 2,
-      "type": "string"
-    },
-    "legalName": {
-      "description": "The client's full legal name, as registered.",
-      "maxLength": 200,
-      "minLength": 2,
-      "type": "string"
-    },
-    "placeOfIncorporation": {
-      "additionalProperties": false,
-      "properties": {
-        "country": {
-          "description": "ISO 3166-1 alpha-2 code, for example US, ES, GB.",
-          "maxLength": 2,
-          "minLength": 2,
-          "type": "string"
-        },
-        "region": {
-          "description": "State or region, for example Delaware.",
-          "maxLength": 100,
-          "type": "string"
-        }
-      },
-      "required": [
-        "country"
-      ],
-      "type": "object"
-    },
-    "registeredAddress": {
-      "maxLength": 400,
-      "minLength": 10,
-      "type": "string"
-    }
-  },
-  "required": [
-    "legalName",
-    "entityType",
-    "placeOfIncorporation",
-    "registeredAddress"
-  ],
-  "type": "object"
-}

removedInput schema / properties / counterparties

Removed value: -{
-  "description": "The legal name of every counterparty to the agreement.",
-  "items": {
-    "$ref": "#/properties/namedPerson/properties/name"
-  },
-  "maxItems": 5,
-  "minItems": 1,
-  "type": "array"
-}

addedInput schema / properties / label

Added value: +{
+  "description": "Optional. A short label for the user to recognize the request, for example \"customer DPA, October\". It must name no one.",
+  "maxLength": 60,
+  "type": "string"
+}

removedInput schema / properties / namedPerson

Removed value: -{
-  "additionalProperties": false,
-  "description": "The person who can bind the client. The engagement goes to this address.",
-  "properties": {
-    "name": {
-      "maxLength": 200,
-      "minLength": 2,
-      "type": "string"
-    },
-    "title": {
-      "maxLength": 120,
-      "minLength": 2,
-      "type": "string"
-    },
-    "workEmail": {
-      "format": "email",
-      "maxLength": 254,
-      "type": "string"
-    }
-  },
-  "required": [
-    "name",
-    "title",
-    "workEmail"
-  ],
-  "type": "object"
-}

changedInput schema / required

Previous value: -[
-  "tool",
-  "client",
-  "namedPerson",
-  "counterparties",
-  "adverseParties"
-]New value: +[
+  "tool"
+]

Changed8 schema fields changedOct 7, 2026

changedInput schema / properties / governingLaw / description

Previous value: -"The law of the DPA: CALIFORNIA by default, or SPAIN."New value: +"The law of the DPA: CALIFORNIA by default, or SPAIN. The law of the BAA: CALIFORNIA only."

addedInput schema / properties / receivesPhi

Added value: +{
+  "description": "BAA only, and required for it: whether the client's services are designed to create, receive, maintain or transmit protected health information. Only false is accepted; for services that handle it, use request_consultation.",
+  "type": "boolean"
+}

removedInput schema / properties / role / default
```
Removed value: -"PROCESSOR"
```

changedInput schema / properties / role / description

Previous value: -"The client's role under the agreement: PROCESSOR by default, or CONTROLLER."New value: +"The client's role under the agreement: PROCESSOR by default, or CONTROLLER. For a BAA: BUSINESS_ASSOCIATE (the default and the only role offered)."

changedInput schema / properties / role / enum

Previous value: -[
-  "PROCESSOR",
-  "CONTROLLER"
-]New value: +[
+  "PROCESSOR",
+  "CONTROLLER",
+  "BUSINESS_ASSOCIATE"
+]

removedInput schema / properties / tool / const
```
Removed value: -"dpa"
```

changedInput schema / properties / tool / description

Previous value: -"The service. Only \"dpa\" (data processing agreement) in this version."New value: +"The service: \"dpa\" (data processing agreement) or \"baa\" (business associate agreement)."

addedInput schema / properties / tool / enum
```
Added value: +[
+  "dpa",
+  "baa"
+]
```

First observedOct 6, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: pricing, what happens after the call (user opens a private link within 24 hours), what the agent never sees, conflicts-check outcomes, and refund behavior. The one-time nature of the matter token is an important operational warning that the schema does not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action and price, then requirements, then return/flow. Every sentence carries information, but the long parenthetical-heavy middle sentence and the engagement/refund explanation make it denser than necessary for a five-field tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description names the return values (matter id, one-time token, private link) and explains the downstream human workflow that determines whether the engagement is accepted. Nothing an agent needs to call this correctly or set user expectations is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds cross-parameter meaning: the BAA forces CALIFORNIA-only law and BUSINESS_ASSOCIATE with receivesPhi false, and it restates the defaults in prose. Much of this duplicates the schema text, which keeps it from a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource ("Starts a request for a data processing agreement") and immediately names the variant switch (tool "baa") plus the price. It also distinguishes itself from the sibling request_consultation at the end, so an agent can route without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Spells out exactly which fields to send, explicit prohibitions ("Do not ask the user for, and do not send, any name, e-mail address or postal address"), naming conventions, and a clear alternative ("A vendor whose services handle protected health information should use request_consultation"). Both the when and the when-not are present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All North End Law tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?