Lawpatch for engineers

Quickstart

1. Sign in and create a project. Copy the API key (shown once).
2. In the root of your repository run the init command from the dashboard. It writes lawpatch.config.json (safe to commit) and stores the key in ~/.lawpatch/credentials.json (never in the repo).
3. Preview exactly what would be sent with --dry-run, then scan.

npx @lawpatch/sdk init --key olv_… --markets EU,UK,US,TR --model b2c
npx @lawpatch/sdk scan --dry-run   # prints the full payload, sends nothing
npx @lawpatch/sdk scan             # local scan → analysis → report link

How the analysis works

Nine steps, seven of them agents. Each one is instrumented, so every report carries a trace of what ran, for how long and at what token cost.

The corpus is not prose: every decision carries its holding, the elements of the legal test as applied, the facts that would distinguish it, where it binds and whether it is still good law. That is what lets the analyst reason by analogy instead of by keyword.

CLI reference

Environment variables: LAWPATCH_API_KEY (overrides the stored key — use it in CI), LAWPATCH_API_URL (self-hosted deployments).

lawpatch.config.json

{
  "projectId": "…",
  "context": {
    "markets": ["EU", "TR", "US"],
    "businessModel": "b2c",
    "sector": "fitness",
    "description": "Coaching app with AI-generated training plans",
    "audienceIncludesChildren": false
  },
  "exclude": ["legacy", "scripts/fixtures"],
  "shareSnippets": false,
  "failOn": "critical"
}

context matters: the same code can be low-risk for a B2B tool and high-risk for a consumer app used by teenagers. shareSnippets attaches a masked one-line snippet to each signal for sharper analysis — strings, numbers, e-mails and URLs are replaced before sending.

MCP server

The SDK includes an MCP server exposing six tools: list_findings, get_fix_brief, get_plan, search_precedents, mark_finding and scan_project — so an agent can check a precedent before making a change, implement a fix, mark it and re-scan to verify. Install it from Connect agents or:

claude mcp add lawpatch -- npx -y @lawpatch/sdk mcp
codex mcp add lawpatch -- npx -y @lawpatch/sdk mcp

CI / GitHub Actions

On a pull request Lawpatch leaves three things behind: inline annotations on the exact lines, a sticky comment that is edited in place on every push rather than piling up, and a job summary. Add --fail-on high and the build goes red before the merge.

# .github/workflows/lawpatch.yml
name: Lawpatch
on: [pull_request]
permissions:
  contents: read
  pull-requests: write        # needed for the sticky comment
jobs:
  legal-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - run: npx -y @lawpatch/sdk scan --comment --fail-on high
        env:
          LAWPATCH_API_KEY: ${{ secrets.LAWPATCH_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The comment carries the risk score, what changed since the last scan (new / regressed / fixed), the top findings with the precedent behind each one, and the recommended fix order. Annotations can be turned off with --no-annotations.

Programmatic API

import { analyze, scanProject } from "@lawpatch/sdk";

// Full round-trip: local scan → analysis → findings
const { findings, riskScore } = await analyze();

// Local only: inspect signals without sending anything
const { payload } = await scanProject({ root: process.cwd(), context });

Security model

• What leaves your machine: rule ids, repo-relative paths, line numbers, safe tokens (package names, field names), dependency names/versions/licences, your project context and, only if enabled, masked one-line snippets. Never file contents. Matched secret values are never sent.
• What we store: scan metadata (counts, languages, frameworks, branch/commit) and findings (file:line references plus analysis). Raw signals are held in memory during analysis and discarded.
• Model calls: OpenAI Responses API with store: false, or any OpenAI-compatible provider you configure. For contractual zero data retention, enable ZDR on the organisation your deployment uses.
• Spend and stability: every scan runs under a token ceiling and per-call timeout; an identical payload re-submitted within a day returns the existing report instead of paying for the same analysis twice.
• Sub-processors (default deployment): Vercel (hosting), Google Firebase / Cloud Firestore (database, auth), OpenAI (analysis).
• Keys: API keys are stored as SHA-256 hashes, can be rotated from the dashboard, and are scoped to one project.

Precedent corpus

A curated set of court decisions and regulator actions across the US, UK, EU, Türkiye and the ECtHR, each summarised as a holding and a concrete lesson for software teams and embedded for semantic retrieval. A weekly job ingests new appellate decisions from CourtListener and, where licensed, The National Archives' Find Case Law. Machine-summarised entries are labelled until an editor verifies them. The counsel agent can only cite decisions that exist in the corpus; a citation guard removes anything else.

Limitations

• Static signals can miss behaviour configured outside the repository (tag managers, CMS, vendor dashboards).
• “Absence” findings (e.g. no cancellation flow found) may be false positives if the feature lives elsewhere — mark them as accepted risk.
• Lawpatch is not a law firm. Reports are risk analysis, not legal advice.