Patch legal risk before it ships.
Lawpatch maps what your product does, matches the risk to real precedent across four markets, and gives your coding agent a verified fix.
npx @lawpatch/sdk scanRuns locally. Your source code never leaves your machine.
Analysis trace
46 precedents matched
How it works
From git clone to compliant in an afternoon.
Init in your repo
One command connects a repository to your Lawpatch project. Tell us where you sell and whether you're B2B, B2C or both.
$ npx @lawpatch/sdk init
? Markets: EU, UK, US, TR
? Business model: b2c
✔ Connected to acme-fit
Scan locally
60+ detectors run on your machine or CI: trackers, session replay, PII fields, consent flows, LLM calls, biometrics, subscriptions, licences.
scanning 1,284 files…
dep.session_replay package.json:7
code.pii_in_logs user.ts:7
● code.account_deletion ✓ mitigation
Agents match precedents
A triage agent groups signals into legal issues; counsel agents retrieve matching court and regulator decisions and model how each could play out.
Fix with one click
Every finding ships with an engineering brief. Open it in Cursor, Claude Code or Codex — or let the agent pull it via Lawpatch's MCP server.
Zero-source architecture
We read your code. We never take it.
Detection runs inside your machine or CI runner. Only derived signals — a rule id, a file path, a line number and a package or field name — are sent for legal analysis, then discarded once findings are written.
- No file contents. Secrets are reported without the matched value; optional snippets are masked one-liners you opt into.
--dry-runprints the exact payload before anything is sent.- Signals held in memory only; LLM calls use store:false.
- Real .env files are skipped by the scanner entirely.
export async function createUser(u) {
console.log("new user", u.email, u.tckn);
const plan = await openai.responses
.create({ input: JSON.stringify(u) });
await stripe.subscriptions.create({
trial_period_days: 7,
});
}{
"rule": "code.pii_in_logs",
"file": "src/lib/user.ts",
"line": 2,
"token": "tckn"
},
{
"rule": "code.llm_call",
"file": "src/lib/user.ts",
"line": 3,
"token": "responses.create"
}What you get
Not a checklist. A case file.
Session replay records visitors before they consent
Hotjar is initialised on every page load, so keystrokes and clicks are captured before any consent is given. In California that pattern is the basis of a wave of wiretap class actions; in the EU it is unlawful access to terminal equipment.
Matched precedents
Javier v. Assurance IQ, LLC
No. 21-16351, 2022 WL 1744107 (9th Cir. May 31, 2022) (unpublished)
Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW
Case C-40/17, ECLI:EU:C:2019:629
Planet49 GmbH v Bundesverband der Verbraucherzentralen
Case C-673/17, ECLI:EU:C:2019:801
Most likely scenario
A firm running automated tests of California-facing sites detects Hotjar firing before consent and sends a pre-suit demand, followed by a putative class action under §631 and §637.2.
Hand off the fix
Send an engineering brief to your coding agent. Lawpatch re-scans to verify.
Explore the full sample report
8 findings · 15 precedents matched
Coverage
Four legal systems. One report.
United States
Class-action exposure from tracking, biometrics and subscriptions.
United Kingdom
ICO enforcement and the new consumer regime.
European Union
CJEU case law and DPA decisions across 27 states.
Türkiye
KVKK Board decisions and Constitutional Court rulings.
Plus a weekly ingestion pipeline from CourtListener and The National Archives, summarised for software lessons and embedded for semantic matching.
Integrations
Lives where your agents already work.
Cursor
One-click prompt deeplinks and MCP install link.
Claude Code
claude mcp add lawpatch — then “fix F-7C21 with Lawpatch”.
Codex
codex mcp add lawpatch and pull briefs from your terminal.
VS Code
MCP install link for agent mode.
GitHub Actions
lawpatch scan --fail-on high blocks risky merges.
Any CI
Programmatic analyze() API in Node 20+.
FAQ
Questions founders ask us
Is this legal advice?+
No. Lawpatch is a risk-analysis tool that helps engineering teams find and prioritise issues with legal consequences. Treat findings the way you treat a security scanner: a high-signal starting point, with counsel for material decisions.
How can you analyse code you never see?+
Detectors run locally and emit signals such as “session replay SDK initialised at src/lib/analytics.ts:4”. That is enough to reason about legal exposure — the same way a lawyer reasons from facts, not from your source.
Where do the precedents come from?+
A curated corpus of court decisions and regulator actions, extended weekly from public sources such as CourtListener and The National Archives. The counsel agent can only cite decisions that exist in the corpus; anything else is stripped by a citation guard.
Which models do you use?+
OpenAI models through the Responses API with storage disabled. Models are configurable per deployment.
Do you support monorepos and mobile apps?+
Yes — JavaScript/TypeScript, Python, Go, Ruby, PHP, Java/Kotlin, Swift, Dart and their manifests, including Info.plist and AndroidManifest permissions.
Find out what a regulator would find — first.
Your first scan takes about two minutes and never uploads a line of code.