Read-only scan of a local project (dependencies + source code + mobile manifests). Detects data processing relevant to legal compliance — analytics, payments, generative AI (distinguishing user-facing AI from server-side-only AI), email collection, third-party sharing — plus structured facts (auth methods, payments channel, AI flags, tracking/IDFA, device permissions), the locales the app supports and the product platforms (web / iOS / Android). Pass suggestedAnswers to generate_policies, and pass facts, locales and signals to claim_app so the generated documents are anchored in evidence.

Read-only compliance readiness check. Run this after adding any SDK, analytics, payment, auth or AI integration — it detects processing activities your legal documents don't cover yet. It scans the project, detects platforms and data processing, auto-derives what it can (app name, legal entity, contact email) and reports which human facts are still missing (including target markets). Returns an agentPrompt you (the dev agent) can answer from the repo, so document generation needs no forms. Call it before make_compliant when you want to confirm facts first.

Generate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets (GDPR, UK GDPR, CCPA…). Returns Markdown. Pass scan_project's suggestedAnswers as answers so the documents disclose the right processing.

Insert the LexVibe cookie-banner + hosted-policies snippet into an HTML file, right before . If the file has no literal (e.g. a Next.js App Router layout.tsx), it does NOT modify the file: it returns the snippet plus exact instructions for you (the dev agent) to add it as JSX. Never corrupts user files.

Classify the system's risk under the EU AI Act and return the applicable obligations with their deadlines.

Free, no-signup compliance check of a DEPLOYED website by URL (the same public checker as the LexVibe /check page). Fetches the live page server-side and detects tracking/processing that actually ships to visitors — analytics, marketing pixels, payments, generative AI, email capture, third parties — and returns per-vendor signals plus concrete recommendations (which documents/banner the site needs) and whether the EU AI Act applies. Complements scan_project (which reads the local source): use check_website after deploying, or for a site whose code you don't have.

Verify that the LexVibe cookie-banner snippet is actually LIVE on a deployed site: fetches the public URL and looks for the widget marker in the served HTML. Run it after deploying (install_snippet edits local files — this confirms the change reached production). Only public http(s) hosts are allowed — localhost, private-network and reserved addresses are rejected. Returns {status: 'ok' | 'missing' | 'unknown'}. If 'missing', the snippet was not found: check that the deploy included the change, or re-run install_snippet and deploy again.

One-step legal compliance: scan the project, generate privacy policy / terms / cookie & AI disclosures (written to /legal), install the cookie-banner snippet into the HTML head, and classify EU AI Act risk. Use this first when the user asks to make their app legally compliant, GDPR-ready, or to add a privacy policy or cookie banner. Returns a summary, any missing human facts, and next steps.

Create a REAL LexVibe app in the user's account (replaces the YOUR_APP_ID placeholder). Returns a claim link: show it to the user so they can sign in and confirm — the link expires in 30 minutes. After they confirm, call get_claim_status with the returned code to retrieve the real app id and install snippet. Use this whenever no real LEXVIBE_APP_ID is configured, so hosted policies, consent proof and auto-updates get linked to the user's account.

Check whether the user has confirmed a claim created with claim_app. While the user hasn't confirmed yet it returns {status: 'pending'} — wait a few seconds and call again (the link expires in 30 minutes). Once claimed it returns the REAL app id, the install snippet, the hosted privacy-policy URL and a pending list of details the code can't know (e.g. the controller's legal name) that the user must still provide: replace any placeholder (YOUR_APP_ID) snippet with the real one, and ask the user for the pending items so the documents can be published.