Checkbox

Set up Checkbox for this project

setup_checkbox

Start here when the user says "add Checkbox", "make my subscriptions compliant", or the project is not connected to Checkbox yet. Checkbox monitors a subscription business against automatic-renewal laws (federal law, 27 states, DC and New York City: FTC ROSCA, California ARL, New York and the other state laws).

Connected through the Checkbox connector (OAuth: claude.ai, Claude Desktop, Claude Code /mcp, Cursor, VS Code): the human already approved in the browser; there is NO key to ask for, paste or save. Call it with site_url (and what else you know): it registers the site and runs the first checks in the same call. Pass everything you already know from the codebase: site_url, checkout_url, terms/privacy/refund/cancellation URLs, billing_platform, plans, project.layout_file. Checkbox fetches and checks the Terms itself.

Only for clients without OAuth (no API key configured on this server): it returns a link for the HUMAN to open and click Approve (free, no card). Show them the link in one line, then call setup_checkbox again with the returned device_code — it waits up to ~50 s; call again while it says pending. On approval the stdio server saves the key to the git-ignored .env.local, showing a hint; the remote one returns it once: save it to .env.local, never commit it or ask for a pasted key.

After this: follow next_action (usually verify the domain and install the snippet, then get_setup_status with verify=true), then get_compliance_plan.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "setup_checkbox"
  }
}

Input Schema

Name	Required	Description
`live`	No	Also request live-mode keys (live mode activates after domain verification). Default false: test mode only.
`agent`	No	Which AI agent is doing this, shown to the human on the approval page, e.g. "Claude Code".
`plans`	No	Plans and prices found in the code, e.g. [{"name":"Pro","amount":1900,"currency":"usd","interval":"month","trial_days":14}]; a promo adds intro_percent_off and intro_periods. They decide which laws apply and what generated copy states.
`project`	No	Facts about the codebase that help Checkbox point tasks at exact files.
`site_url`	No	Public URL of the site (production, or a preview deployment), e.g. "https://acme.example".
`terms_url`	No	Terms of service URL. Checkbox fetches and checks it.
`refund_url`	No	Refund policy URL.
`account_url`	No	Account page where subscribers manage / cancel (null clears a URL).
`device_code`	No	From an earlier setup_checkbox call: poll that browser approval instead of starting a new one.
`privacy_url`	No	Privacy policy URL.
`checkout_url`	No	Page where customers subscribe (pricing or checkout page).
`merchant_name`	No	The brand subscribers know (names the seller in generated disclosures), e.g. from the <title> or package.json (also accepted as "brand"). Default: the host name, which the plan then asks you to replace.
`support_email`	No	Support address for subscribers.
`billing_platform`	No	Billing platform.
`cancellation_url`	No	Cancellation policy URL, if separate from the Terms.

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedNov 9, 2026

changedInput schema / properties / billing_platform / description

Previous value: -"Billing platform the code uses."New value: +"Billing platform."

changedInput schema / properties / billing_platform / enum

Previous value: -[
-  "stripe",
-  "shopify",
-  "recharge",
-  "chargebee",
-  "recurly",
-  "paddle",
-  "woocommerce",
-  "custom"
-]New value: +[
+  "stripe",
+  "shopify",
+  "recharge",
+  "chargebee",
+  "recurly",
+  "paddle",
+  "lemon_squeezy",
+  "woocommerce",
+  "custom"
+]

changedInput schema / properties / support_email / description

Previous value: -"Support address subscribers can write to."New value: +"Support address for subscribers."

Changed6 schema fields changedNov 8, 2026

changedInput schema / properties / plans / description

Previous value: -"Plans and prices found in the code, e.g. [{\"name\":\"Pro\",\"amount\":1900,\"currency\":\"usd\",\"interval\":\"month\",\"trial_days\":14}]. They decide which laws apply (trials, annual terms)."New value: +"Plans and prices found in the code, e.g. [{\"name\":\"Pro\",\"amount\":1900,\"currency\":\"usd\",\"interval\":\"month\",\"trial_days\":14}]; a promo adds intro_percent_off and intro_periods. They decide which laws apply and what generated copy states."

addedInput schema / properties / plans / items / properties / intro_amount

Added value: +{
+  "description": "Promo first-period price, minor units.",
+  "minimum": 0,
+  "type": "integer"
+}

addedInput schema / properties / plans / items / properties / intro_amount_off
```
Added value: +{
+  "exclusiveMinimum": 0,
+  "type": "integer"
+}
```

addedInput schema / properties / plans / items / properties / intro_percent_off

Added value: +{
+  "exclusiveMaximum": 100,
+  "exclusiveMinimum": 0,
+  "type": "number"
+}

addedInput schema / properties / plans / items / properties / intro_periods

Added value: +{
+  "maximum": 36,
+  "minimum": 1,
+  "type": "integer"
+}

addedInput schema / properties / plans / items / properties / price_id

Added value: +{
+  "description": "Stripe Price id.",
+  "maxLength": 200,
+  "type": "string"
+}

Changed16 schema fields changedNov 8, 2026

addedInput schema / properties / account_url / anyOf

Added value: +[
+  {
+    "maxLength": 2048,
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

changedInput schema / properties / account_url / description

Previous value: -"Account page where subscribers manage / cancel."New value: +"Account page where subscribers manage / cancel (null clears a URL)."

removedInput schema / properties / account_url / maxLength
```
Removed value: -2048
```
removedInput schema / properties / account_url / type
```
Removed value: -"string"
```

addedInput schema / properties / cancellation_url / anyOf

Added value: +[
+  {
+    "maxLength": 2048,
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

removedInput schema / properties / cancellation_url / maxLength
```
Removed value: -2048
```
removedInput schema / properties / cancellation_url / type
```
Removed value: -"string"
```

addedInput schema / properties / privacy_url / anyOf

Added value: +[
+  {
+    "maxLength": 2048,
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

removedInput schema / properties / privacy_url / maxLength
```
Removed value: -2048
```
removedInput schema / properties / privacy_url / type
```
Removed value: -"string"
```

addedInput schema / properties / refund_url / anyOf

Added value: +[
+  {
+    "maxLength": 2048,
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

removedInput schema / properties / refund_url / maxLength
```
Removed value: -2048
```
removedInput schema / properties / refund_url / type
```
Removed value: -"string"
```

addedInput schema / properties / terms_url / anyOf

Added value: +[
+  {
+    "maxLength": 2048,
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

removedInput schema / properties / terms_url / maxLength
```
Removed value: -2048
```
removedInput schema / properties / terms_url / type
```
Removed value: -"string"
```

Changed2 schema fields changedNov 8, 2026

changedInput schema / additionalProperties
```
Previous value: -falseNew value: +true
```

changedInput schema / properties / merchant_name / description

Previous value: -"The brand subscribers know (names the seller in generated disclosures), e.g. from the <title> or package.json. Default: the host name, which the plan then asks you to replace."New value: +"The brand subscribers know (names the seller in generated disclosures), e.g. from the <title> or package.json (also accepted as \"brand\"). Default: the host name, which the plan then asks you to replace."

First observedNov 5, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false, openWorldHint=true, idempotentHint=false and destructiveHint=false. The description adds real operational context the annotations cannot: it registers a site and runs checks in one call, waits ~50s on device-code polling, writes the key into a git-ignored .env.local (or returns it once on the remote server), and must never be pasted or committed. Minor gap: it does not say what the response looks like beyond "next_action".

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with triggers and the primary path, then the fallback path, then the follow-up sequence, so structure is strong. Some duplication ("there is NO key to ask for, paste or save" vs. "never commit it or ask for a pasted key") costs it the top score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers both auth modes, the failure/wait behavior, secret handling, and the next tools to call, which is a lot for a 15-parameter, nested-object tool with no output schema. It stops short of describing the returned payload (keys, next_action shape) or what "runs the first checks" actually yields, which an agent would benefit from.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description actively guides parameter use: it lists which facts to pass (site_url, checkout_url, terms/privacy/refund/cancellation URLs, billing_platform, plans, project.layout_file) and explains device_code as "poll that browser approval instead of starting a new one". That adds selection logic beyond the schema's own field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ("Set up Checkbox for this project") and anchors it with real trigger phrases ("add Checkbox", "make my subscriptions compliant", not connected yet). The reader immediately knows this is the entry-point connector/registration tool, distinct from get_setup_status, complete_setup and update_setup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use triggers plus a clear split between the OAuth path (human already approved, no key) and the no-OAuth device-code path with its polling loop. It also sequences the work: run this first, follow next_action, then call get_setup_status with verify=true, then get_compliance_plan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Checkbox tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.