MCP server

The MCP server is how AI agents read your standards live, rather than from a file that went stale three approvals ago.

https://policycodex-mcp.thoughtlabs.workers.dev/mcp

Transport: streamable HTTP. Authentication: a bearer API key, which also scopes every response to your organisation.

Connecting

Claude Code
mcp.json
MCP Inspector

claude mcp add --transport http policycodex \
  https://policycodex-mcp.thoughtlabs.workers.dev/mcp \
  --header "Authorization: Bearer $POLICYCODEX_API_KEY"

{
  "mcpServers": {
    "policycodex": {
      "type": "http",
      "url": "https://policycodex-mcp.thoughtlabs.workers.dev/mcp",
      "headers": {
        "Authorization": "Bearer ${POLICYCODEX_API_KEY}"
      }
    }
  }
}

npx @modelcontextprotocol/inspector

Set the transport to Streamable HTTP, the URL to https://policycodex-mcp.thoughtlabs.workers.dev/mcp, and add an Authorization: Bearer <key> header.

Tools

`list_domains`

The organisation’s architecture domains with RFC counts. No arguments. Useful as an agent’s first call, to discover what scoping is available.

`get_statements`

The main tool. Returns governed statements, each with a stable slug, an RFC 2119 level, and the RFC it came from.

Argument	Type	Description
`domain`	string	Domain slug, e.g. `api-design`
`level`	enum	`MUST`, `MUST NOT`, `SHOULD`, `SHOULD NOT`, `MAY`
`sdlc_stage`	string	`design`, `implementation`, `review`, `ci`, `operations`
`status`	enum	`approved` or `enforced` — defaults to `enforced`

get_statements({ domain: "api-design", level: "MUST" })

The default of enforced is deliberate: an agent that asks a vague question gets the blocking rules, not the advisory ones. Pass status: "approved" when you want the grace-period statements too.

`get_rfc`

Full Markdown body and metadata for one RFC, by slug. Use it when an agent needs the reasoning behind a statement rather than the statement alone.

get_rfc({ slug: "api-design-guidelines" })

`check_compliance`

Evaluates a unified diff against the enforced statements and returns findings citing statement slugs. MUST-level findings are blocking.

Argument	Type	Description
`diff`	string	Unified diff of the change
`domain`	string	Restrict to one domain slug
`tree`	string[]	Repository file listing (paths only)

Pass tree. A diff alone cannot show that a required file is missing — the file listing is what makes “every service MUST have an OpenAPI spec” checkable.

This is the same evaluation the GitHub Action runs, so an agent can check its own work before opening the pull request.

Using it well

Filter by domain

A service that only touches HTTP APIs does not need the incident-response corpus. Narrower context means better adherence.

Filter by SDLC stage

A design-review agent wants sdlc_stage=design. An implementation agent wants implementation. Sending both the whole corpus wastes context and dilutes attention.

Cite the slug

Ask your agent to reference statement slugs when it applies a rule. That is what makes its reasoning auditable against the corpus.

Prefer MCP over a file

AGENTS.md is a snapshot; MCP is live. Use the compiled file where a tool can only read files, and MCP everywhere else.

For agents

For CI

Connecting

Tools

`list_domains`

`get_statements`

`get_rfc`

`check_compliance`

Using it well

​Connecting

​Tools

​list_domains

​get_statements

​get_rfc

​check_compliance

​Using it well

Connecting

Tools

`list_domains`

`get_statements`

`get_rfc`

`check_compliance`

Using it well