# Lawmatics Mcp Server

> Model Context Protocol server for the Lawmatics OAuth API

- **Type:** MCP server
- **Install:** `agentstack add mcp-dschnurbusch-lawmatics-mcp-server`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [dschnurbusch](https://agentstack.voostack.com/s/dschnurbusch)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [dschnurbusch](https://github.com/dschnurbusch)
- **Source:** https://github.com/dschnurbusch/lawmatics-mcp-server

## Install

```sh
agentstack add mcp-dschnurbusch-lawmatics-mcp-server
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Lawmatics MCP Server

A standalone Model Context Protocol (MCP) server for the Lawmatics OAuth API. It exposes Lawmatics contacts, companies, matters/prospects, tasks, notes, forms, time entries, expenses, tags, events, files/folders, users, reference resources, and a guarded raw API tool to AI agents.

This project is intentionally account-neutral. It does **not** ship with anyone's Lawmatics credentials and does **not** persist tokens. Users provide their own OAuth app settings or access token in their MCP client environment.

## Status

Early but working. The server currently registers 100+ tools and is built from Lawmatics OAuth API v1.21.0 docs.

## Install

```bash
npm install -g lawmatics-mcp-server
```

Or run from a checkout:

```bash
git clone https://github.com/dschnurbusch/lawmatics-mcp-server.git
cd lawmatics-mcp-server
npm install
npm run build
node dist/index.js
```

## Authentication

Fast path: provide an access token from your own Lawmatics account/app.

```bash
LAWMATICS_ACCESS_TOKEN=your_access_token_here
LAWMATICS_API_BASE_URL=https://api.lawmatics.com/v1
```

OAuth helper tools are included:

- `lm_oauth_authorization_url`: builds the Lawmatics authorization URL.
- `lm_oauth_exchange_code`: exchanges an authorization code for tokens.
- `lm_oauth_refresh_token`: refreshes an access token.

OAuth environment variables:

```bash
LAWMATICS_CLIENT_ID=
LAWMATICS_CLIENT_SECRET=
LAWMATICS_REDIRECT_URI=http://localhost:3333/oauth/callback
LAWMATICS_OAUTH_AUTHORIZE_URL=https://app.lawmatics.com/oauth/authorize
LAWMATICS_OAUTH_TOKEN_URL=https://api.lawmatics.com/oauth/token
```

### Can users authorize against someone else's Lawmatics OAuth app?

Probably, if Lawmatics allows that OAuth application to authorize external Lawmatics accounts and the redirect URI/client settings are valid. But for a public MCP server, the safer default is **bring your own Lawmatics OAuth app**.

Do not publish your `client_secret`. A public package can document an optional shared `client_id`, but the secret belongs in the user's local MCP environment or in a backend you control. This server therefore supports BYO `LAWMATICS_CLIENT_ID` and `LAWMATICS_CLIENT_SECRET` and never embeds Dan's app credentials.

## MCP client configuration

### Claude Desktop / Cursor style

```json
{
  "mcpServers": {
    "lawmatics": {
      "command": "npx",
      "args": ["-y", "lawmatics-mcp-server"],
      "env": {
        "LAWMATICS_ACCESS_TOKEN": "YOUR_TOKEN"
      }
    }
  }
}
```

### Hermes Agent

```yaml
mcp_servers:
  lawmatics:
    command: "npx"
    args: ["-y", "lawmatics-mcp-server"]
    env:
      LAWMATICS_ACCESS_TOKEN: "${LAWMATICS_ACCESS_TOKEN}"
    timeout: 180
    connect_timeout: 60
```

## Tool catalog

Auth and OAuth:

- `lm_whoami`
- `lm_oauth_authorization_url`
- `lm_oauth_exchange_code`
- `lm_oauth_refresh_token`

Core CRM:

- `lm_get_matter_context` is the high-signal context tool for agents. Given `matter_id`, it returns compact matter detail plus related contacts/relationships, tasks, documents/files/folders, notes/interactions/activities, and optional billing (`include_billing=true`). It strips JSON:API wrapper noise, relationship blobs, empty fields, and long free-text bodies into `untrusted_*_preview` fields.
- Contacts: `lm_list_contacts`, `lm_get_contact`, `lm_create_contact`, `lm_update_contact`, `lm_delete_contact`, `lm_find_contact`
- Companies: `lm_list_companies`, `lm_get_company`, `lm_create_company`, `lm_update_company`, `lm_delete_company`, `lm_find_company`
- Matters/prospects: `lm_list_matters`, `lm_get_matter`, `lm_get_matter_context`, `lm_create_matter`, `lm_update_matter`, `lm_delete_matter`, `lm_find_matter`
- Notes: `lm_list_notes`, `lm_get_note`, `lm_create_note`, `lm_update_note`, `lm_delete_note`
- Tasks: `lm_list_tasks`, `lm_get_task`, `lm_create_task`, `lm_update_task`, `lm_delete_task`

Forms:

- `lm_list_forms`
- `lm_get_form`
- `lm_list_form_entries`
- `lm_submit_form`

Billing/time:

- `lm_list_time_entries`, `lm_get_time_entry`, `lm_create_time_entry`, `lm_update_time_entry`, `lm_delete_time_entry`
- `lm_list_expenses`, `lm_get_expense`, `lm_create_expense`, `lm_update_expense`, `lm_delete_expense`
- `lm_list_invoices`, `lm_list_transactions`

Other resources:

- Tags: list/get/create/update/delete plus `lm_attach_tag`, `lm_detach_tag`
- Events, files, folders, interactions, relationships, addresses, email addresses, phone numbers
- Users and reference resources: sources, practice areas, stages, pipelines, campaigns, task statuses, custom fields, contact types, sub statuses, relationship types, event types, locations, activities
- `lm_raw_api_call`: guarded generic API call for endpoints not yet wrapped

The generated plural/singular names are intentionally simple in this first version. Better aliases can be added without removing the existing names.

## Safety model

- Write tools accept `dry_run`; when true they return the planned request without calling Lawmatics.
- `lm_raw_api_call` defaults writes to dry-run. Pass `dry_run=false` to execute.
- `DELETE` tools require `confirm=true`.
- The server does not store tokens, OAuth codes, refresh tokens, or client secrets.
- Never commit `.env` files. Use `.env.example` only.

## Development

```bash
npm install
npm test
npm run build
```

Run a local MCP smoke test:

```bash
node dist/index.js
```

Integration tests are opt-in and require a real token:

```bash
LAWMATICS_ACCESS_TOKEN=... npm run test:integration
```

Write/destructive integration tests should be added behind an additional explicit flag. Do not run them against a real production Lawmatics account unless you intend to create records.

## API docs

The raw Postman collection is not committed because it contains token-like examples that trigger GitHub push protection. A sanitized endpoint catalog generated from Lawmatics OAuth API v1.21.0 is included instead:

- `docs/api-endpoints.md`

## License

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [dschnurbusch](https://github.com/dschnurbusch)
- **Source:** [dschnurbusch/lawmatics-mcp-server](https://github.com/dschnurbusch/lawmatics-mcp-server)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-dschnurbusch-lawmatics-mcp-server
- Seller: https://agentstack.voostack.com/s/dschnurbusch
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.