Lawmatics Mcp Server

Lawmatics MCP Server

A standalone Model Context Protocol (MCP) server for the Lawmatics OAuth API. It exposes Lawmatics contacts, companies, matters/prospects, tasks, notes, forms, time entries, expenses, tags, events, files/folders, users, reference resources, and a guarded raw API tool to AI agents.

This project is intentionally account-neutral. It does not ship with anyone's Lawmatics credentials and does not persist tokens. Users provide their own OAuth app settings or access token in their MCP client environment.

Status

Early but working. The server currently registers 100+ tools and is built from Lawmatics OAuth API v1.21.0 docs.

Install

npm install -g lawmatics-mcp-server

Or run from a checkout:

git clone https://github.com/dschnurbusch/lawmatics-mcp-server.git
cd lawmatics-mcp-server
npm install
npm run build
node dist/index.js

Authentication

Fast path: provide an access token from your own Lawmatics account/app.

LAWMATICS_ACCESS_TOKEN=your_access_token_here
LAWMATICS_API_BASE_URL=https://api.lawmatics.com/v1

OAuth helper tools are included:

• lm_oauth_authorization_url: builds the Lawmatics authorization URL.
• lm_oauth_exchange_code: exchanges an authorization code for tokens.
• lm_oauth_refresh_token: refreshes an access token.

OAuth environment variables:

LAWMATICS_CLIENT_ID=
LAWMATICS_CLIENT_SECRET=
LAWMATICS_REDIRECT_URI=http://localhost:3333/oauth/callback
LAWMATICS_OAUTH_AUTHORIZE_URL=https://app.lawmatics.com/oauth/authorize
LAWMATICS_OAUTH_TOKEN_URL=https://api.lawmatics.com/oauth/token

Can users authorize against someone else's Lawmatics OAuth app?

Probably, if Lawmatics allows that OAuth application to authorize external Lawmatics accounts and the redirect URI/client settings are valid. But for a public MCP server, the safer default is bring your own Lawmatics OAuth app.

Do not publish your client_secret. A public package can document an optional shared client_id, but the secret belongs in the user's local MCP environment or in a backend you control. This server therefore supports BYO LAWMATICS_CLIENT_ID and LAWMATICS_CLIENT_SECRET and never embeds Dan's app credentials.

MCP client configuration

Claude Desktop / Cursor style

{
  "mcpServers": {
    "lawmatics": {
      "command": "npx",
      "args": ["-y", "lawmatics-mcp-server"],
      "env": {
        "LAWMATICS_ACCESS_TOKEN": "YOUR_TOKEN"
      }
    }
  }
}

Hermes Agent

mcp_servers:
  lawmatics:
    command: "npx"
    args: ["-y", "lawmatics-mcp-server"]
    env:
      LAWMATICS_ACCESS_TOKEN: "${LAWMATICS_ACCESS_TOKEN}"
    timeout: 180
    connect_timeout: 60

Tool catalog

Auth and OAuth:

• lm_whoami
• lm_oauth_authorization_url
• lm_oauth_exchange_code
• lm_oauth_refresh_token

Core CRM:

• lm_get_matter_context is the high-signal context tool for agents. Given matter_id, it returns compact matter detail plus related contacts/relationships, tasks, documents/files/folders, notes/interactions/activities, and optional billing (include_billing=true). It strips JSON:API wrapper noise, relationship blobs, empty fields, and long free-text bodies into untrusted_*_preview fields.
• Contacts: lm_list_contacts, lm_get_contact, lm_create_contact, lm_update_contact, lm_delete_contact, lm_find_contact
• Companies: lm_list_companies, lm_get_company, lm_create_company, lm_update_company, lm_delete_company, lm_find_company
• Matters/prospects: lm_list_matters, lm_get_matter, lm_get_matter_context, lm_create_matter, lm_update_matter, lm_delete_matter, lm_find_matter
• Notes: lm_list_notes, lm_get_note, lm_create_note, lm_update_note, lm_delete_note
• Tasks: lm_list_tasks, lm_get_task, lm_create_task, lm_update_task, lm_delete_task

Forms:

• lm_list_forms
• lm_get_form
• lm_list_form_entries
• lm_submit_form

Billing/time:

• lm_list_time_entries, lm_get_time_entry, lm_create_time_entry, lm_update_time_entry, lm_delete_time_entry
• lm_list_expenses, lm_get_expense, lm_create_expense, lm_update_expense, lm_delete_expense
• lm_list_invoices, lm_list_transactions

Other resources:

• Tags: list/get/create/update/delete plus lm_attach_tag, lm_detach_tag
• Events, files, folders, interactions, relationships, addresses, email addresses, phone numbers
• Users and reference resources: sources, practice areas, stages, pipelines, campaigns, task statuses, custom fields, contact types, sub statuses, relationship types, event types, locations, activities
• lm_raw_api_call: guarded generic API call for endpoints not yet wrapped

The generated plural/singular names are intentionally simple in this first version. Better aliases can be added without removing the existing names.

Safety model

• Write tools accept dry_run; when true they return the planned request without calling Lawmatics.
• lm_raw_api_call defaults writes to dry-run. Pass dry_run=false to execute.
• DELETE tools require confirm=true.
• The server does not store tokens, OAuth codes, refresh tokens, or client secrets.
• Never commit .env files. Use .env.example only.

Development

npm install
npm test
npm run build

Run a local MCP smoke test:

node dist/index.js

Integration tests are opt-in and require a real token:

LAWMATICS_ACCESS_TOKEN=... npm run test:integration

Write/destructive integration tests should be added behind an additional explicit flag. Do not run them against a real production Lawmatics account unless you intend to create records.

API docs

The raw Postman collection is not committed because it contains token-like examples that trigger GitHub push protection. A sanitized endpoint catalog generated from Lawmatics OAuth API v1.21.0 is included instead:

• docs/api-endpoints.md

License

MIT

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: dschnurbusch
• Source: dschnurbusch/lawmatics-mcp-server
• License: MIT

Install and usage instructions live in the source repository linked above.