North End Law
by northend.law · remote · no sign-in to list tools · v1.0.0 · published by law.northend
Data processing agreement, $350 flat fee, reviewed and released by a lawyer.
11 tools: 4 change things and 7 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads7Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http dpa https://northend.law/api/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnopen_matter
The description names a tool "baa" that this server does not list.
What this check looks forMatched text
description: "...ta processing agreement ($350) or, with tool "baa", a business associate agreement ($350)...."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
11 tools
Changes things 4Claude Code: ask
open_matterStarts a request for a data processing agreement ($350) or, with tool "baa", a business associate agreement ($350).1 finding
Why it is in this group
- The name "open_matter" says "open": a word for a change.
Findings
- Warn
The description names a tool "baa" that this server does not list.
What this check looks forMatched text
description: "...ta processing agreement ($350) or, with tool "baa", a business associate agreement ($350)...."
Description, as the server wrote it Starts a request for a data processing agreement ($350) or, with tool "baa", a business associate agreement ($350). Send only the service, the governing law (CALIFORNIA by default, or SPAIN; CALIFORNIA only for a BAA), the client's role (PROCESSOR by default, or CONTROLLER; BUSINESS_ASSOCIATE for a BAA, with receivesPhi false) and, if useful, a short label that names no one. Do not ask the user for, and do not send, any name, e-mail address or postal address: the firm never needs them from you. Write "the Client" for the user's company and "the Customer" (or "the Vendor", when the client is the controller) for the other party. Returns a matter id, a matter token (shown once: keep it) and a private link. Give the private link to the user and ask them to open it in their browser within 24 hours. There the user enters their company's details, their own and the other party's, and the firm runs its conflicts check. You never see those details. The firm accepts the engagement when its automatic conflicts check is clear and payment is received (for a subscriber, when the engagement is accepted and the check is clear). If a possible conflict is found, nothing is charged, or the payment is refunded in full. A vendor whose services handle protected health information should use request_consultation.
request_consultationFor anything outside the listed services: gives the booking link and lets the firm know a person would like to talk.No findings
Why it is in this group
- The name "request_consultation" says "request": a word for a change.
Description, as the server wrote it For anything outside the listed services: gives the booking link and lets the firm know a person would like to talk. Send a one-line topic only, no confidential facts.
submit_dpa_factsThe fact package for the agreement, in the "dealroom.solo-intake/1" shape described by get_dpa_requirements.No findings
Why it is in this group
- The name "submit_dpa_facts" says "submit": a word for a change.
Description, as the server wrote it The fact package for the agreement, in the "dealroom.solo-intake/1" shape described by get_dpa_requirements. Accepted only once the engagement has begun, and again when the lawyer asks for changes. Leave out counterpartyLegalName: the firm adds the other party from the private page. Do not ask the user for, and do not send, any name, e-mail address or postal address: the firm never needs them from you. Write "the Client" for the user's company and "the Customer" (or "the Vendor", when the client is the controller) for the other party. A fact package that contains a name, an e-mail address or a postal address the firm holds for the matter is refused.
submit_factsThe fact package for the matter's service, in the "dealroom.solo-intake/1" shape described by get_requirements.No findings
Why it is in this group
- The name "submit_facts" says "submit": a word for a change.
Description, as the server wrote it The fact package for the matter's service, in the "dealroom.solo-intake/1" shape described by get_requirements. Accepted only once the engagement has begun, and again when the lawyer asks for changes. Leave out counterpartyLegalName: the firm adds the other party from the private page. Do not ask the user for, and do not send, any name, e-mail address or postal address: the firm never needs them from you. Write "the Client" for the user's company and "the Customer" (or "the Vendor", when the client is the controller) for the other party. A fact package that contains a name, an e-mail address or a postal address the firm holds for the matter is refused. For a business associate agreement, the facts must not contain protected health information: they describe the services, not any individual.
Only reads 7Claude Code: allow
get_deliverableOnce a lawyer has released it: the agreement in Markdown with placeholders ([Client], [Customer] or [Vendor], and blank addresses and signatures), so you can explain it to the user…No findings
Why it is in this group
- The name "get_deliverable" says "get": a word for reading.
Description, as the server wrote it Once a lawyer has released it: the agreement in Markdown with placeholders ([Client], [Customer] or [Vendor], and blank addresses and signatures), so you can explain it to the user. The final agreement with the parties' details, in PDF and Word, is only on the private page and in the e-mail to the person who signs.
Annotations the server declares
- readOnlyHint: true
get_dpa_requirementsThe facts the data processing agreement needs, as a JSON Schema.No findings
Why it is in this group
- The name "get_dpa_requirements" says "get": a word for reading.
Description, as the server wrote it The facts the data processing agreement needs, as a JSON Schema. Optionally narrowed to one governing law and the client's role. Do not send the facts until the engagement has begun.
Annotations the server declares
- readOnlyHint: true
get_engagement_termsThe full limited-scope engagement text for a service, with its version and SHA-256 hash, and whether it is open for acceptance.No findings
Why it is in this group
- The name "get_engagement_terms" says "get": a word for reading.
Description, as the server wrote it The full limited-scope engagement text for a service, with its version and SHA-256 hash, and whether it is open for acceptance.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_matter_statusWhere the matter stands, the next human step, the target in business hours, and any question from the lawyer.No findings
Why it is in this group
- The name "get_matter_status" says "get": a word for reading.
Description, as the server wrote it Where the matter stands, the next human step, the target in business hours, and any question from the lawyer.
Annotations the server declares
- readOnlyHint: true
get_payment_linkThe firm's own card payment page for $350, available once the named person has accepted the engagement.No findings
Why it is in this group
- The name "get_payment_link" says "get": a word for reading.
Description, as the server wrote it The firm's own card payment page for $350, available once the named person has accepted the engagement. The fee is charged in full at checkout and refunded in full if the firm declines the matter or does not deliver. The link is also e-mailed to the named person.
get_requirementsThe facts a service needs, as a JSON Schema: service "dpa" (data processing agreement) or "baa" (business associate agreement).No findings
Why it is in this group
- The name "get_requirements" says "get": a word for reading.
Description, as the server wrote it The facts a service needs, as a JSON Schema: service "dpa" (data processing agreement) or "baa" (business associate agreement). For a DPA, optionally narrowed to one governing law and the client's role. Do not send the facts until the engagement has begun.
Annotations the server declares
- readOnlyHint: true
list_servicesWhat North End Law offers through this server, at what fixed price, under which laws, and who is responsible.No findings
Why it is in this group
- The name "list_services" says "list": a word for reading.
Description, as the server wrote it What North End Law offers through this server, at what fixed price, under which laws, and who is responsible. Responsible lawyer: Sergio Maldonado Elvira, Founder & Principal Attorney, North End Law Corporation, 447 Sutter St. Suite 506 - 1349, San Francisco, California 94108, United States.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http dpa https://northend.law/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__dpa__list_services",
"mcp__dpa__get_requirements",
"mcp__dpa__get_dpa_requirements",
"mcp__dpa__get_engagement_terms",
"mcp__dpa__get_matter_status",
"mcp__dpa__get_payment_link",
"mcp__dpa__get_deliverable"
],
"ask": [
"mcp__dpa__request_consultation",
"mcp__dpa__open_matter",
"mcp__dpa__submit_facts",
"mcp__dpa__submit_dpa_facts"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as dpa. Review it before you use it.