@privacytracker/mcp

Model Context Protocol server for PrivacyTracker. Exposes the local privacy library — apps, privacy labels, change history, AI policy summaries — to any MCP-compatible client (Claude Desktop, Claude Code, Cline, etc.).

This is a read-only proxy. It talks to a running PrivacyTracker instance over its existing HTTP API; it does not touch the SQLite database directly and never mutates state.

Prerequisites

• A running PrivacyTracker instance (local pnpm dev, Docker, or remote install).

• Node.js 20 or newer on the machine running the MCP client.

Related MCP server: paycoreDb

Install

You don't need to clone this repo to use the server — every MCP client can spawn it via npx:

npx -y @privacytracker/mcp

For local development from a clone:

pnpm install
pnpm build
node dist/index.js

Configuration

The server reads three environment variables:

A 401 response from the server triggers a clear MCP error explaining which side of the token contract is wrong.

Claude Desktop config

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "privacytracker": {
      "command": "npx",
      "args": ["-y", "@privacytracker/mcp"],
      "env": {
        "PRIVACYTRACKER_BASE_URL": "http://localhost:3000",
        "PRIVACYTRACKER_ADMIN_TOKEN": "..."
      }
    }
  }
}

Restart Claude Desktop and the privacytracker server will appear in the tools menu.

Available tools

All tools are read-only and map 1:1 to existing PrivacyTracker API endpoints.

Available resources

Local development

pnpm install
pnpm dev          # tsx watch mode
pnpm typecheck
pnpm test
pnpm lint
pnpm build

To smoke-test against a running PrivacyTracker instance:

PRIVACYTRACKER_BASE_URL=http://localhost:3000 pnpm start

The server speaks JSON-RPC over stdio. Use the MCP Inspector for interactive exploration:

npx @modelcontextprotocol/inspector node dist/index.js

Versioning

This package versions independently of PrivacyTracker itself. Tag a release (v0.x.y) on main and the publish workflow ships it to npm automatically.

License

Apache-2.0. See LICENSE.