Track AI laws inside Claude Code and Cursor with MCP

What the connector actually exposes

The MCP server is a thin, read-oriented shell over the same versioned /v1 API the rest of these guides use. Every tool maps one-to-one onto a real endpoint, and all tier gating, quota and data-quality rules stay server-side — the connector only carries your key through and hands the JSON back.

The server is stateless and tools-only: it advertises the tools capability and nothing else. There are no resources and no prompts, so a client that asks for them gets an empty list rather than a surprise.

• Endpoint: https://ai-law-tracker.com/mcp (the legacy alias https://ai-law-tracker.com/api/mcp stays live forever).
• Transport: Streamable HTTP, one JSON-RPC 2.0 message per POST. The server never opens a server-initiated SSE stream — a GET returns 405 by design.
• Server name: ai-law-tracker. Latest protocol version spoken: 2025-11-25 (2025-06-18, 2025-03-26 and 2024-11-05 are also accepted).
• Auth: optional. No key = the anonymous tier. Add your key as the X-API-Key header (or Authorization: Bearer <key>) to move onto your own tier.
• Discovery: the server card is published at /.well-known/mcp/server-card.json and /mcp/server-card.

Step 1 — grab a free key (optional, but do it)

The connector works with no key at all: an anonymous caller gets a real, low-quota tier rather than a 401. That is fine for a first look, but the anonymous list cap is 5 records with a trimmed field set, and the MCP endpoint additionally rate-limits unauthenticated traffic per IP.

A free key raises you to 60 requests/minute and 2,000 requests/day, and — this is the part that matters — returns the COMPLETE record envelope (summary, source, dates, in_force) with up to 25 rows per page. Filters and sorting are honoured at every tier.

curl -X POST "https://ai-law-tracker.com/api/v1/keys" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@company.com"}'

{
  "api_version": "v1",
  "key": "alt_free_9f3c…",
  "key_prefix": "alt_free_9f3c",
  "tier": "free",
  "email": "you@company.com",
  "note": "Copy your key now — it is shown once on this screen. We also emailed it to you…",
  "docs": "https://ai-law-tracker.com/developers"
}

Step 2 — add it to Claude Code

The one-liner registers the remote server for your user scope and attaches the key header. Swap the placeholder for your real key.

claude mcp add --transport http ai-law-tracker https://ai-law-tracker.com/mcp \
  --header "X-API-Key: alt_free_your_key_here"

{
  "mcpServers": {
    "ai-law-tracker": {
      "type": "http",
      "url": "https://ai-law-tracker.com/mcp",
      "headers": {
        "X-API-Key": "alt_free_your_key_here"
      }
    }
  }
}

Step 3 — add it to Cursor

Cursor reads ~/.cursor/mcp.json for a global server and .cursor/mcp.json inside a project for a repo-scoped one. The remote-server block is the same shape in both.

{
  "mcpServers": {
    "ai-law-tracker": {
      "url": "https://ai-law-tracker.com/mcp",
      "headers": {
        "X-API-Key": "alt_free_your_key_here"
      }
    }
  }
}

Step 4 — verify the connection without leaving the terminal

The server is stateless, so tools/list answers on its own without a prior handshake. That makes a one-line curl the fastest way to prove the URL and the key are both right before you blame the editor.

curl -s "https://ai-law-tracker.com/mcp" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: alt_free_your_key_here" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

curl -s "https://ai-law-tracker.com/mcp" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: alt_free_your_key_here" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "search_ai_laws",
      "arguments": { "q": "facial recognition", "limit": 5 }
    }
  }'

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      { "type": "text", "text": "{ \"api_version\": \"v1\", \"query\": \"facial recognition\", \"data\": [ … ], \"meta\": { … } }" }
    ]
  }
}

Step 5 — prompts that actually use the data

MCP tools only help if the model reaches for them. These phrasings reliably route to the right tool because they name the thing the tool returns.

• “Search AI Law Tracker for state laws about automated hiring decisions and give me each one’s official_url.” → search_ai_laws
• “List the upcoming AI compliance deadlines for California and quote the raw source text for each.” → get_ai_deadlines
• “What jurisdictions does AI Law Tracker cover, with record counts?” → list_jurisdictions / list_us_states / list_countries
• “Pull the source links behind record <id> and tell me which are primary .gov sources.” → get_law_sources
• “Show me the change timeline for this record.” → get_law_history (Developer tier and above)

What the connector will not do

• It is not legal advice. Every tool description says so, and the server instructions tell the model to verify against each record’s official_url.
• It does not invent records. When a tier cannot see a paid surface, the tool returns the real 403 body with its upgrade hint rather than a fabricated answer — get_law_history, list_recent_changes and list_law_feed are Developer-and-above; get_ai_obligations and assess_ai_compliance are Pro-and-above.
• It never negotiates OAuth. There is deliberately no OAuth metadata: an anonymous caller gets a real low-quota tier, so the server never returns 401 and never triggers a discovery dance.

The tools, and the endpoint behind each

Every tool is a thin proxy onto a real /v1 endpoint — tier gating, quota and data quality stay server-side.

FAQ

Keep going