openlaw-mcp

> by **LegalAI Space**

A free, open-source Model Context Protocol (MCP) server that exposes UK and EU open law — judgments, statutes, regulations, regulator notices — to host LLMs such as Claude, ChatGPT, and Cursor.

Where general-purpose chatbots invent citations, `openlaw-mcp` fetches the real text from official open-data sources (The National Archives' Find Case Law, legislation.gov.uk, EUR-Lex, HUDOC, ICO, HMRC) and returns it with full provenance and licence attribution. Every tool result is cite-back ready.

Install

Three ways to use openlaw-mcp:

1. Free hosted endpoint — fastest path, zero install, point your client at our URL.

2. Local stdio — runs inside Claude Desktop / Cursor / Claude Code via `npx`.

3. Self-hosted HTTP — `node dist/http.js` after `npm run build`.

1. Free hosted Streamable HTTP endpoint

A community endpoint is available at `https://openlawmcp.legalaispace.com/v1/mcp`. No API key, no signup, no rate-limit gate beyond the per-IP throttle. Best-effort uptime — no SLA, may be rate-limited, throttled, or migrated as load grows.

Codex CLI

codex mcp add openlaw --url https://openlawmcp.legalaispace.com/v1/mcp

Claude Code CLI

claude mcp add --transport http openlaw https://openlawmcp.legalaispace.com/v1/mcp

Claude Desktop / Cursor (config file)

{
  "mcpServers": {
    "openlaw": {
      "url": "https://openlawmcp.legalaispace.com/v1/mcp"
    }
  }
}

Health check: `curl https://openlawmcp.legalaispace.com/healthz` should return `{"status":"ok","service":"openlaw-mcp"}`.

2. Claude Desktop / Cursor / Claude Code (stdio)

Runs locally — no dependency on the hosted endpoint.

{
  "mcpServers": {
    "openlaw": {
      "command": "npx",
      "args": ["-y", "@legalaispace/openlaw-mcp"]
    }
  }
}

3. Self-host the HTTP transport

npm install
npm run build
node dist/http.js   # listens on PORT (default 3000), mount /v1/mcp

Behind a reverse proxy (nginx, Cloudflare, etc.), set `TRUST_PROXY` to the number of proxy hops so `express-rate-limit` keys by the real client IP — see Configuration.

Sample prompts

Once the server is configured, paste any of these into your host LLM. They are UK-focused and chosen to exercise the tools where MCP grounding makes the biggest difference — exact statute text, point-in-time status, judgment paragraph quotes, regulator deep links, and ICO / HMRC material that a plain web search cannot reliably return verbatim.

Statute lookups (`lookup_statute`, `legislation_toc`)

• "Quote subsection (1) of section 1 of the UK Bribery Act 2010 verbatim, with a link to the legislation.gov.uk source."
• "What is the current in-force text of section 1 of the Online Safety Act 2023 (c.50) on legislation.gov.uk? If the section has not been commenced, say so and cite the source you used."
• "What did section 2 of the Data Protection Act 2018 say as in force on 25 May 2018? Use legislation.gov.uk's point-in-time view."
• "Give me the table of contents for the Procurement Act 2023 — parts, chapters, and section numbers."
• "Compare the wording of section 1 of the Computer Misuse Act 1990 as enacted vs as currently in force, and cite both versions on legislation.gov.uk."

Case law (`search_caselaw`, `fetch_judgment`, `grep_judgment`, `citator_lite`)

• "Quote paragraph 1 of *R (on the application of Miller) v The Prime Minister* [2019] UKSC 41 verbatim, with the Find Case Law URL."
• "Find UK Supreme Court judgments from 2024 onwards that consider Article 8 of the ECHR. Return neutral citations with Find Case Law links and a one-line summary of each."
• "In *Uber BV v Aslam* [2021] UKSC 5, find every paragraph that mentions the word 'control' and quote each one in full."
• "List judgments published on Find Case Law that cite *Pepper v Hart* [1992] UKHL 3. Return neutral citations and links — no treatment classification needed."
• "Search Find Case Law for First-tier Tribunal (Tax Chamber) decisions on IR35 / off-payroll working handed down in 2023, and return the first 10 hits."

Regulator material (`search_fca_handbook`, `fetch_fca_notice`, `search_ico_guidance`, `fetch_hmrc_manual`)

• "Give me the official handbook.fca.org.uk deep link for SYSC 4.1.1R."
• "Resolve these FCA rule references into deep links: SYSC 6.1.1R, COBS 9.2.1R, CASS 7.13.3R."
• "Find recent ICO enforcement actions (monetary penalty notices and enforcement notices) issued in 2025 — return the title, date, and source URL for each."
• "From the HMRC Business Income Manual, give me the section on the badges of trade (BIM20205). Return the bodyText and the gov.uk URL."
• "From the HMRC Employment Status Manual (ESM), summarise the contents page (just the navigation tree, not the bodies)."

EU material (`fetch_eurlex`)

• "Fetch CELEX 32016R0679 (the GDPR) and return Article 5 in full, with the EUR-Lex source URL."
• "Fetch CELEX 32024R1689 (the EU AI Act) and tell me which articles deal with prohibited AI practices."

ECHR / Strasbourg (`fetch_hudoc`)

• "Pull the full English text of the ECHR judgment in *Bărbulescu v Romania* (Application 61496/08) and quote the operative paragraphs."
• "Search HUDOC for Grand Chamber judgments where the United Kingdom was the respondent state between 2020 and 2024."

Citation hygiene (`format_oscola`)

• "Format the following bundle of UK cases in OSCOLA, one per line: *Donoghue v Stevenson* [1932] AC 562; *Pepper v Hart* [1992] UKHL 3; *R (Miller) v The Prime Minister* [2019] UKSC 41."
• "Convert this sloppy reference into OSCOLA and produce a working Find Case Law URL: 'Uber BV v Aslam, 2021 Supreme Court, UKSC 5'."

When MCP shines (and when it doesn't)

• Strongest payoff: "verbatim text of section X" prompts, point-in-time statute lookups, FCA Handbook deep-link resolution, and any request that needs *current* in-force wording or a recent ICO/HMRC publication. Generic web search either guesses or gets blocked by upstream JS challenges (notably legislation.gov.uk's AWS WAF); the MCP server is allow-listed and returns parsed, cite-ready XML.
• Marginal payoff: quoting a famous paragraph from a landmark judgment, or formatting a textbook citation. The host LLM often gets these from training data alone — MCP still adds provenance and reduces hallucination risk, but the wording would have been correct anyway.
• No payoff: purely conceptual questions ("explain the difference between the FCA and the PRA"). These should be answered without calling any tool; if your host LLM fires MCP tools here, treat it as an over-eager router rather than a useful grounding.

Tools

[^1]: FCA materials are link-only / metadata-only. The server does not fetch FCA Handbook or notice body text, and notice listing is disabled unless FCA grants written permission for automated access. Users are pointed to the FCA's own site for authoritative content. See `ATTRIBUTIONS.md` for the legal posture.

Resources

Clients that support MCP resources can also read:

How tools and resources work technically

Common runtime flow (all tools)

1. MCP client sends tool name + JSON arguments (`inputSchema` validated by `zod`).

2. Server handler calls either:

3. Handler normalizes/parses upstream data into stable `data` fields.

4. Server returns an envelope: `data`, `provenance` (`source`, `source_url`, `fetched_at`, `content_hash`, `cache_hit`, licence metadata), and `learn_more`; some tools also include `note`.

5. On upstream errors, tools return `isError: true` plus a canonical authoritative URL.

Per-tool technical behavior

• `search_caselaw`: receives search filters (`query`, optional `court`/date/page), fetches TNA Atom feed, parses entries into normalized judgment refs, returns paged hits + provenance.
• `fetch_judgment`: receives neutral citation or TNA URI, resolves to `/data.xml`, parses Akoma Ntoso into `meta`, `header`, `paragraphs`, returns full structured judgment + provenance.
• `grep_judgment`: same fetch/parsing as `fetch_judgment`, then runs JS regex across parsed paragraph text, returns match list/snippets + provenance.
• `lookup_statute`: receives legislation type/year/number/section (+ optional `as_of`), fetches CLML section XML, extracts title/text/version metadata/extent/prospective flags, returns normalized section document + provenance.
• `legislation_toc`: receives legislation type/year/number, fetches CLML contents XML, flattens parts/chapters/sections into entries, returns TOC + provenance.
• `fetch_eurlex`: receives CELEX, validates/normalizes it, blocks out-of-scope national sectors (7/8), fetches from Cellar with content negotiation (XHTML then HTML fallback), returns raw body + detected media type + provenance.
• `fetch_hudoc`: receives either `itemid` or search query. Search path fetches JSON results and suppresses out-of-policy records. Item path fetches metadata then body only when language/doctype/translation guard passes. Returns records/body + provenance + suppression note when applicable.
• `search_fca_handbook`: receives parsed handbook reference inputs, computes deterministic deep link locally, returns metadata + local provenance (`urn:openlaw-mcp:local`) without FCA content fetch.
• `fetch_fca_notice`: receives known notice slug (+ category), computes deterministic FCA deep link locally, returns metadata + local provenance; listing path intentionally errors (scraping disabled).
• `search_ico_guidance`: receives optional type/sector/date/page filters, posts to ICO `/api/search`, shapes response into enforcement list items, returns paged results + provenance.
• `fetch_hmrc_manual`: receives manual slug (+ optional section slug), fetches GOV.UK Content API JSON, returns either manual navigation tree or section body (`bodyHtml` + `bodyText`) + provenance.
• `format_oscola`: receives citation text + formatting options, parses and formats locally (OSCOLA/Bluebook), optionally emits derived Find Case Law URL for neutral citations, returns formatted output + local provenance.
• `citator_lite`: receives neutral citation, searches TNA Atom with quoted query to find citing judgments, trims to limit, returns citing list + disclaimer + provenance.

Per-resource technical behavior

• `judgment://.../header`: MCP resource vars (`slug`, `year`, `number`) are validated/parsed, server fetches TNA judgment XML once, extracts plain-text header, returns `text/plain`.
• `judgment://.../index`: same fetch path, maps parsed paragraphs to `{ eId, num, preview }`, returns `application/json`.
• `judgment://.../para/{eId}`: same fetch path, selects one paragraph by exact Akoma Ntoso `eId`, returns `text/plain` (`[num] text` when `num` exists).
• `statute://.../section/{section}`: validates resource vars, fetches legislation.gov.uk section XML via legislation client, returns parsed section document JSON.

Provenance

Every tool response carries a `provenance` block:

{
  "data": { },
  "provenance": {
    "source": "Find Case Law",
    "source_url": "https://caselaw.nationalarchives.gov.uk/uksc/2024/12/data.xml",
    "fetched_at": "2026-05-12T12:00:00Z",
    "content_hash": "sha256-...",
    "cache_hit": false,
    "licence": "Open Justice Licence v2.0",
    "licence_url": "https://caselaw.nationalarchives.gov.uk/open-justice-licence",
    "attribution": "Contains information licensed under the Open Justice — Licence v2.0"
  },
  "learn_more": "https://legalaispace.com"
}

If you redistribute the content downstream, preserve the attribution.

Limitations

• No BAILII. BAILII's terms prohibit programmatic re-use; the client blocks all outbound requests to it.
• No FCA scraping or full text. FCA Handbook and Notices are link-only / metadata-only by design. Known slugs and references are converted into deep links; the server does not enumerate FCA notices or fetch FCA page/PDF bodies without written permission.
• HUDOC scope. Only English/French Court-authored judgments. Third-party translations are excluded.
• Find Case Law coverage is E&W courts and tribunals from 2001 onwards. Older judgments are out of scope.
• EUR-Lex Member State legislation reached via N-Lex is excluded; only EU-authored content is fetched.
• legislation.gov.uk WAF. `www.legislation.gov.uk` is fronted by an AWS WAF that issues a JavaScript challenge (`HTTP 202 Accepted` with `x-amzn-waf-action: challenge` and an empty body) to clients whose IPs it considers suspicious — typically datacenter egress. From a residential network or an allow-listed deployment the API serves XML normally. Affected calls (`lookup_statute`, `legislation_toc`) surface a clear error and retry with backoff; we do not bypass the challenge by fingerprint-spoofing.
• Caselaw is not training data. `openlaw-mcp` fetches on demand for individual user queries; it does not maintain a persistent cross-user index of fetched content.

Troubleshooting

`lookup_statute` / `legislation_toc` fail with an AWS WAF challenge

The error you see in your host LLM will read something like:

> `upstream responded with an AWS WAF JavaScript challenge (HTTP 202) on every attempt`

`www.legislation.gov.uk` is fronted by an AWS WAF that issues a JavaScript challenge to clients whose IPs it considers suspicious — typically datacenter egress, some VPNs, and an evolving list of residential prefixes. The server detects the challenge (`HTTP 202`, `x-amzn-waf-action: challenge`, empty body) and surfaces a structured error rather than spoof fingerprints to bypass it. See Limitations for the design rationale.

What to do:

• Run from a residential or allow-listed network, or point your host LLM at the free hosted endpoint, which runs from an allow-listed IP.
• The legislation tools (`lookup_statute`, `legislation_toc`) are the only tools affected by the legislation.gov.uk WAF. Caselaw (`search_caselaw`, `fetch_judgment`, `grep_judgment`), ICO, HMRC, EUR-Lex, HUDOC, FCA Handbook, and OSCOLA formatting all use independent upstreams and continue to work.
• Quick sanity check from your shell:

curl -s -o /dev/null -w "%{http_code}\n" https://www.legislation.gov.uk/ukpga/2010/23/section/1/data.xml

`200` → the API is reachable from your network. `202` → WAF is challenging your IP.

`npx -y @legalaispace/openlaw-mcp` fails to start in Claude Desktop / Cursor / Claude Code

• Confirm `node --version` is `>= 22` (`engines.node` in `package.json`). On Windows, install Node via nvm-windows or fnm; on Linux, prefer your distribution's Node 22+ package or Volta.
• First-run `npx` downloads the package; subsequent runs are cached. If your host LLM kills the spawn before the download completes, run `npm install -g @legalaispace/openlaw-mcp` once and switch the config to `{ "command": "openlaw-mcp" }`.

Cache acting up

Cached responses live in `~/.cache/openlaw-mcp/http-cache.sqlite` (override with `OPENLAW_CACHE_DIR`; disable with `OPENLAW_DISABLE_CACHE=1`). Delete the file to force a fresh fetch from upstreams. See Cache for the multi-tenant guidance.

Circuit breaker tripped

The shared fetcher trips a per-host circuit breaker on repeated 5xx / network errors and cools down for 30 seconds before retrying. If you see "circuit open" errors, wait, then retry — and check the upstream's own status page.

Configuration

All configuration is via environment variables.

Cache

By default, GET responses are cached in `~/.cache/openlaw-mcp/http-cache.sqlite`

with source-specific TTLs. Delete the cache directory to clear stored responses.

> Multi-tenant deployments: The cache is shared across all callers of a

> given process. The TNA Find Case Law content is licensed under the Open

> Justice Licence v2.0, whose "computational analysis" carve-out does not

> permit a persistent cross-user retrieval index. If you are running the HTTP

> transport for more than one end-user, either set `OPENLAW_CACHE_DIR=off`

> or give each tenant its own ephemeral cache directory. Single-user stdio

> usage (`npx @legalaispace/openlaw-mcp`) is unaffected.

Takedown

If you are a rights-holder and believe content fetched by this server has been redistributed in error, please email `daman@legalaispace.com`. We will investigate within five working days.

Development

npm install
npm run dev:stdio          # run the stdio server locally
npm run dev:http           # run the Streamable HTTP server with watch
npm test                   # unit tests, MCP protocol tests, and the ICO fixture test
npm run lint && npm run typecheck
npm run build
npm pack --dry-run         # verify npm package contents; runs release gates

License and attribution

Source code is Apache-2.0; see `LICENSE`. Upstream-data attributions and prior-art credit (notably `paulieb89/uk-legal-mcp`) are in `ATTRIBUTIONS.md`.

Development assisted by AI and Daman Kaur.

The information returned by this server is for information and research only and does not constitute legal advice.