LegalPocket CLI

MCP-ready command-line client for the LegalPocket cloud backend.

main is the only permanent product branch. Open a feat/, fix/, chore/, or hotfix/ pull request into main. npm publication happens only from annotated cli-vX.Y.Z tags. See docs/release-workflow.md.

Install

Install the version-pinned 0.1.4 release using the package-manager workflow you already use, or use the version-pinned LegalPocket installer.

Pick the package-manager workflow you already use:

# npm (global install)
npm install --global @legalpocketai/[email protected]

# npx (run the setup wizard without a global install)
npx @legalpocketai/[email protected] mcp setup

# pnpm
pnpm add --global @legalpocketai/[email protected]

# Bun
bun add --global @legalpocketai/[email protected]

# curl installer from the versioned public LegalPocket download (requires Node.js 24+ and npm)
curl -fsSL "https://www.legalpocketai.com/downloads/legalpocket-cli/v0.1.4/install.sh" | sh

After installing, legalpocketai install <npm|npx|pnpm|bun|curl> prints the corresponding exact install command. The curl workflow deliberately uses a versioned LegalPocket download URL, never a mutable default-branch script. The installer checks that Node.js is version 24 or newer and that the exact package release exists on npm before it installs anything.

Commands

npm install
npm run build

legalpocketai login
legalpocketai whoami
legalpocketai import ./contract.pdf
legalpocketai list
legalpocketai analyze ./contract.pdf
legalpocketai analyze https://www.apple.com/legal/privacy/
legalpocketai analyze apple.com
legalpocketai ask ./contract.pdf "What are the biggest risks?"
legalpocketai chat ./contract.pdf

legalpocketai is the primary command. The legacy legalpocket command remains available as a compatibility alias.

The default API base is https://api.legalpocketai.com. Override it with LEGALPOCKET_API_BASE_URL for local or preview backends.

legalpocketai login opens a LegalPocket-hosted browser sign-in flow and stores the resulting session locally. Use legalpocketai login --no-browser to print the login URL without opening a browser on the same machine.

The CLI stores session metadata under the platform application data directory, or under LEGALPOCKET_DATA_DIR when that variable is set.

Website analysis

legalpocketai analyze accepts an HTTPS URL or a bare domain such as apple.com. Bare domains are normalized to HTTPS. LegalPocket analyzes the page you request after ordinary HTTPS redirects; it does not silently discover or substitute a different privacy policy or terms page.

Website retrieval uses a 15-second total deadline, at most five redirects, and a 5 MiB response limit. Every destination and redirect is resolved and pinned to public network addresses; private, local, reserved, link-local, credentialed, cleartext HTTP, and nonstandard-port destinations are rejected. The response must be UTF-8 HTML. Navigation, scripts, styles, forms, and other non-content noise are removed, while the complete remaining visible text is retained with the final source URL and page title. Empty or oversized pages fail clearly; legal text is never silently truncated.

Analyzing a stored document ID reuses its exact saved content. Re-entering a URL fetches the current page again, so changed website content is a new review.

Supported Files

The CLI mirrors the app import surface:

• pdf
• docx
• rtf
• txt
• md / markdown
• png
• jpg / jpeg
• heic

PDF text extraction is native-first. Image-only PDF pages and standalone images use the OCR adapter.

Remote MCP Server

The Vercel-hosted MCP endpoint is https://api.legalpocketai.com/api/mcp. It is a user-authenticated remote service, not a bridge to this machine's local SQLite library or file paths. Its initial tools accept document text/chunks:

• legalpocket_get_account
• legalpocket_review_document
• legalpocket_ask_document

Connect with an MCP client that supports OAuth 2.1. The server advertises its protected-resource metadata and routes users through LegalPocket authentication; do not copy a CLI session token into an MCP configuration.

For Codex, the setup wizard also supplies the MCP endpoint as the OAuth resource parameter. This makes the direct MCP fallback use the same resource identity as the Codex plugin.

The CLI can print or apply client setup without handling user tokens:

# Show the command and complete browser OAuth sign-in.
legalpocketai mcp setup codex --apply
legalpocketai mcp setup claude-code --apply

# Print JSON configuration for editors and other clients.
legalpocketai mcp setup cursor
legalpocketai mcp setup other

Codex App Plugin

This repository also contains a native Codex plugin package. Unlike legalpocketai login, the plugin does not write a LegalPocket token into a local configuration file and does not ask an agent to handle credentials. It declares the remote MCP as an OAuth resource, so Codex owns the authorization session instead of exposing credentials to the agent.

For local development from this checkout:

codex plugin marketplace add .
codex plugin add legalpocket@legalpocket

Then open Codex Settings → Plugins → LegalPocket. If Codex presents an authentication action for the MCP component, complete the LegalPocket sign-in in the browser window opened by Codex. The direct runtime fallback remains:

codex mcp login legalpocket

After this plugin package is available on the repository's default branch, it can be installed without a checkout:

codex plugin marketplace add RINNECODER/LegalPocket-CLI --ref main
codex plugin add legalpocket@legalpocket

The marketplace requests authentication on install, and .mcp.json supplies both the Streamable HTTP endpoint and its OAuth resource identifier. No Authorization header, bearer token, client secret, or CLI session is embedded in the plugin.

First-class Connect button

The repository metadata can make the MCP OAuth-aware, but it cannot mint an OpenAI app/connector ID. A guaranteed app-backed Connect button on the plugin page requires LegalPocket to be registered as a custom app in the target OpenAI workspace. OpenAI issues the app ID during that process; only then can the plugin safely reference it from .app.json.

See docs/codex-app-registration.md for the one-time registration and final linking steps. Never invent an app ID or ask an agent to enter a user's LegalPocket credentials or approve consent.