What you get at the end
The open-source Lawmatics MCP server (@oktopeak/lawmatics-mcp, MIT licensed) gives Claude 37 tools against your Lawmatics account: matters, contacts, companies, pipelines and stages, practice areas, marketing sources, sub-statuses, users, tasks, events, notes, timeline activities, tags, custom fields, intake form submissions, and read-only invoices. Once it is wired up, these are ordinary questions you type into Claude:
Lawmatics🔒 runs on your machine · token never leaves it · read-only mode available
- How many matters are in each pipeline stage, broken down by practice area?
- Which marketing sources produced the matters that converted this quarter?
- Pull up the intake form answers for the Alvarez matter.
- List every overdue task and who owns it.
Claude picks the tools, pages through the API, and assembles the answer. Under the hood it leans on what the Lawmatics API does well: finders that look up a record by email, phone, or name, single-condition filters with operators like like and ilike with % wildcards, and field selection down to fields=custom_fields when only the intake answers matter. It also works around what the API does poorly: pages are fixed at 25 records and each request accepts exactly one filter, so multi-condition reports mean Claude walks the pages and applies the rest of the logic itself. That is invisible to you beyond a report taking a minute instead of a second.
Every call is appended to a local audit log at ~/.lawmatics-mcp/audit.log, one JSON line per tool call with its arguments, so you hold your own record of what the AI touched and when. If you are still weighing this route against Zapier's Lawmatics app, the honest comparison is in Lawmatics MCP vs Zapier; the short version is that Zapier's surface has no custom fields, no invoices, no pipeline reads, and no tasks.
One thing stated plainly before you invest the 15 minutes: the connector was built from Lawmatics' official API documentation and has not yet been verified against a live firm account, because Lawmatics gates API access behind a support request. Everything below matches the documented behavior. If your account behaves differently anywhere, file an issue on GitHub and we will fix it fast.
Email support
1 email, then wait
Create the app
3 minutes
One-time auth
2 minutes, once ever
Point Claude at it
5 minutes
What you need
- A Lawmatics account with admin access, so you can create the OAuth app once Developer Settings is enabled.
- Node.js 18 or later.
- Claude Desktop or Claude Code. The connector runs locally as a child process. It is not a hosted service, and your access token stays on your machine.
Step 0: Email Lawmatics support first
This is the step nobody warns you about, and it is the only one you cannot control the timing of. Lawmatics API access is gated. The Developers section does not exist in your Settings until Lawmatics support enables it for your account. It is free, but you have to ask.
Email api@lawmatics.com, or use the in-app support chat, with something like:
Send that before you do anything else, because every step below depends on it. While you wait, you can install Node and read the rest of this guide; the technical part takes 15 minutes once support flips the switch.
Step 1: Create the OAuth app in Lawmatics
Once Developer Settings is on, go to Settings → Developers in Lawmatics and create a new application. The one field that matters is the Callback URL:
http://localhost:5678/callbackSave the app and copy the Client ID and Client Secret. These are credentials to your intake system. Do not email them to anyone, including us.
Step 2: Run the one-time auth command
In a terminal, with your own values substituted:
LAWMATICS_CLIENT_ID=xxx LAWMATICS_CLIENT_SECRET=yyy \
npx -y @oktopeak/lawmatics-mcp authYour browser opens to the Lawmatics login, you approve the app, and the command prints an access token.
This token never expires. Lawmatics OAuth issues no refresh tokens, so the token from this step is permanent until you revoke the app inside Lawmatics. That is why auth is a one-time step rather than a recurring login, and it is also why the token deserves password-grade handling. Store it in the config file below and nowhere else.
Step 3: Point Claude at the connector
Claude Desktop. Open the config file:
- Mac:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
Add this inside the "mcpServers" section, pasting the token from Step 2:
claude_desktop_config.json
{
"mcpServers": {
"lawmatics": {
"command": "npx",
"args": ["-y", "@oktopeak/lawmatics-mcp"],
"env": {
"LAWMATICS_ACCESS_TOKEN": "paste_your_token_here"
}
}
}
}If the file already lists other MCP servers, add a comma after the previous entry before pasting the "lawmatics" block. A missing comma is a JSON syntax error and Claude Desktop will silently not load the connector. Then quit Claude Desktop completely and reopen it.
Claude Code. One line:
claude mcp add lawmatics -e LAWMATICS_ACCESS_TOKEN=your_token \
-- npx -y @oktopeak/lawmatics-mcpVerify. In a new conversation, type:
Who am I logged in as in Lawmatics?Claude calls the get-current-user tool and answers with your Lawmatics user. If it does, you are done: 37 tools, live against your account.
A good first real prompt is one bounded question rather than a firm-wide sweep: "list the matters in the Consultation Scheduled stage" or "find the contact with email jsmith@example.com and show their intake form answers." A specific question comes back in seconds and proves the wiring; asking for a summary of 800 matters on minute one turns your first impression into a pagination exercise. Save the big reports for when you trust the small ones.
Read-only mode for cautious firms
If the idea of an AI holding write access to your intake system gives anyone at the firm pause, good instinct, and there is a switch for it. Add one line to the env block:
"LAWMATICS_READ_ONLY": "1"With that set, every write tool is removed from the set Claude can see. This is a hard guarantee at the connector level rather than an instruction Claude is asked to follow: the write tools do not exist in the session. All the reporting prompts above work fully in read-only mode, which is why we suggest most firms start here and lift the restriction only when there is a concrete write workflow they want.
Two related flags worth knowing. The local audit log at ~/.lawmatics-mcp/audit.log records every tool call including its arguments; if that log itself is a concern on a shared machine, disable it with LAWMATICS_AUDIT_LOG=0. And custom-field writes are experimental, hidden behind LAWMATICS_EXPERIMENTAL_TOOLS=1, because Lawmatics under-documents the write format. Custom-field reads are standard and always on.
Troubleshooting the four common failures
Why am I getting a 401 error?
Because the token is wrong, and only because the token is wrong. Lawmatics tokens never expire, so "it must have expired" is never the diagnosis. Check for a copy-paste truncation, stray whitespace, or quotes copied into the value. If the token is definitely right, the other cause is that Developer Settings was never actually enabled on the account, in which case the auth step itself would have failed; redo Step 0.
The auth command fails before the browser opens. What now?
Almost always Step 0. If Lawmatics support has not enabled Developer Settings, there is no Developers section, no valid app, and the OAuth flow has nothing to talk to. This is a support-queue problem and no amount of local debugging fixes it. Reply to your email to api@lawmatics.com and ask for status.
Port 5678 is already in use. Can I change it?
Yes. Set LAWMATICS_REDIRECT_PORT to a free port when running the auth command, and update the Callback URL in your Lawmatics app to match, for example http://localhost:9876/callback. The port in the environment variable and the port in the registered callback must agree or the OAuth redirect fails.
Claude says it hit a rate limit (429). Is something broken?
No. Lawmatics rate-limits the API, and its own docs state the ceiling as 50 requests per minute in one place and 150 in another. The connector throttles itself to 50 per minute client-side, the safe reading, so sustained sweeps pace themselves. If a 429 still appears, the pagination math explains why big questions take time: the API returns a fixed 25 records per page and accepts one filter per request, so "summarize all 800 matters" is 32+ calls before analysis starts. Scope the question, or let Claude work through it patiently.
What it cannot do
Three limits to know before you promise anyone a workflow. No stage moves: the Lawmatics API has no endpoint for moving a matter between pipeline stages, so neither does any integration built on it; updating a matter's sub-status is the closest write. Pull-only: the connector answers when Claude asks and does not react to events. Lawmatics webhooks (13 event types, including matter.created, form.submitted, and invoice.paid) exist, but they are configured in the Lawmatics dashboard and need their own receiving endpoint; the connector does not consume them. Custom-field writes are experimental, as covered above, until Lawmatics documents the write shape properly. Invoices are deliberately read-only.
One decision that matters more than the install
Lawmatics holds prospect and intake data rather than privileged case files, which puts it a rung below a practice management system on the sensitivity ladder. It is still client information, sometimes including the story a prospect told your intake form before they became a client, so the question of which Claude sits behind the connector is worth thirty seconds of deliberate thought.
With any hosted model, whatever the connector reads goes to the AI provider for inference. Nobody selling you an integration should claim otherwise. The defensible configuration for sensitive content is a Claude plan with training disabled and zero data retention, which in practice means enterprise-tier Claude or the API rather than a consumer subscription. If your firm already made this call for its practice management data, apply the same answer here; if it has not, this install is a good forcing function to make it once for everything.
If the config file is not your idea of an afternoon
The steps above assume someone at the firm is comfortable with a terminal and a JSON file. If nobody is, that is a normal state for a law firm and not a reason to skip the whole thing. We do a guided setup: a screen share where we walk your first person through every step on their own machine, credentials never leaving your hands, and most firms are asking their own pipeline questions by the end of the call.
And if you are rolling this out to more than one person, per-laptop installs are the wrong shape: every machine is its own setup and nobody holds a firm-level record of what AI touched. We run the same connector from one place your firm controls, with one audit log for everyone. One setup, every attorney.
Sources: the Lawmatics API documentation at api.lawmatics.com/v1, the @oktopeak/lawmatics-mcp source and README on GitHub, and the official MCP Registry listing io.github.oktopeak/lawmatics-mcp. Checked August 2026.
