# Legal Context Protocol (LCP)

> An open standard for discovering the legal context of agentic commerce transactions.

The Legal Context Protocol defines a single well-known URI — `/.well-known/legal-context.json` — where any service publishes a reference to its legal terms. The standard requires no specific technology: no blockchain, no cryptography beyond standard HTTPS, no API, no third-party service. Any web server can implement it.

## Core Concept

AI agents are transacting autonomously. No agentic commerce protocol — MPP, ACP, x402, UCP, AP2, Visa TAP, Mastercard Agent Pay — systematically addresses the legal layer: what were the terms? Did the counterparty consent? What is the dispute process? Who has jurisdiction? LCP fills this gap.

## The Standard (Normative)

A service MUST serve a JSON document at `https://{domain}/.well-known/legal-context.json` over HTTPS.

The only required field is `terms` — an absolute HTTPS URL pointing to a standalone, downloadable legal terms document.

Optional fields provide increasing levels of trust:
- `termsFormat` — signals format/schema of the terms document (e.g., "markdown", "json", "plain", "pdf", "html")
- `atrHash` — SHA-256 hash of the Agentic Transaction Record (ATR) — the ATR is the terms document itself, and `atrHash` is its digest (Level 2: Provable)
- `acceptanceRequired` — if true, counterparties must explicitly accept before transacting (Level 3: Signed)
- `disputeResolution` — structured dispute resolution with `method`, `jurisdiction`, `contact`, `clauseId`, `source`, `catalog` (Level 4: Integrated)
- `returns`, `contact`, `api` — operational integration hooks

The optional fields are a machine-readable INDEX of what the terms document says. They are not themselves
terms. A provision appearing only in legal-context.json and not in the terms document is advertising, not
agreement; where the two differ, the terms document controls.

atrHash equality is defined on the decoded 32 bytes: lowercase emission is RECOMMENDED, and implementations
MUST compare the decoded bytes rather than the strings, so an uppercase-hex atrHash is conforming.

## Minimal Example

```json
{
  "terms": "https://example.com/terms/v3.md"
}
```

## Full Example

```json
{
  "terms": "https://example.com/terms/v3.json",
  "termsFormat": "json",
  "atrHash": "0x7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069",
  "acceptanceRequired": true,
  "disputeResolution": {
    "method": "Dispute Resolution Service Rules",
    "jurisdiction": "New York, USA",
    "contact": "disputes@example.com",
    "clauseId": "sha256:0xc2eb26d28ff4e229ff35917bd53339d82c1b30ec69435572a8872a4d7609c1dd",
    "source": "https://adr.example.org/clauses/dispute-resolution-service-rules",
    "catalog": "https://adr.example.org/.well-known/dispute-services.json"
  },
  "contact": {
    "legal": "legal@example.com",
    "technical": "api-support@example.com"
  },
  "api": "https://api.example.com/legal-context/v1"
}
```

## Four Levels of Trust

1. **Informational** — Terms are discoverable at a known URL. Proceeding constitutes implicit consent — the browsewrap pattern.
2. **Provable** — An ATR hash proves what the terms were and that they have not changed.
3. **Signed** — A digital signature provides cryptographic proof of explicit consent.
4. **Integrated** — Hooks to dispute resolution, escrow, compliance, and private terms infrastructure.

## Protocol Integration

LCP integrates with every major agentic commerce protocol via existing extension mechanisms:
- MPP: LCP fields inside the challenge `request.methodDetails`. The challenge-id binding is computed under a key the SERVER holds, so it does not commit the seller to a relying party. Custom outer parameter names MUST be lowercase
- ACP: `legalContext` in checkout-session `metadata`. The `links` type enum is closed at eight values, and CheckoutSessionBase is additionalProperties:false, so no extension declaration can add a top-level field
- ACK: `legalContext` in the ACK-Pay receipt credential's `metadata` — covered by the issuer's proof
- x402: `legalContext` entry (`{info, schema}` shape) in the `extensions` map, carried on the PaymentRequired challenge, PaymentPayload, and SettlementResponse
- UCP: `policies[]` in the base checkout schema (open reverse-DNS type vocabulary; platforms MUST tolerate unknown values). There is NO extensions map on the checkout response
- Visa TAP: a custom HTTP header is available but UNBOUND (covered components are @authority and @path); the RFC 9421 parameter is `keyid`, not `kid`
- A2A: task metadata, plus Agent Card `capabilities.extensions[]` — declaration is NOT activation; the client must send an `A2A-Extensions` header and check the echoed response header
- MCP: an LCP-aware MCP server exposing tools, resources and prompts. Tool annotations describe environmental effect, not legal significance — they are not a legal-significance signal
- AP2: alongside mandates in transport metadata — AP2 defines no transport of its own. A custom constraint inside an open mandate fails schema validation; the constraints array is a closed anyOf
- Mastercard Verifiable Intent: no Tier A carrier — verifiers MUST reject open mandates carrying unknown constraint types, and Immediate-mode credentials carry no constraints array at all; registration is the path

## Key Properties

- One required field (`terms`). Everything else is optional.
- Backward compatible. Implementations ignore unrecognized fields.
- Technology-agnostic. No blockchain, no cryptography beyond standard HTTPS, no specific infrastructure required.
- Complementary to authorization protocols. LCP provides the merchant's terms; TAP/Verifiable Intent/AP2 provide the consumer's authorization.

## Links

- Specification: https://legalcontextprotocol.org/standard
- Schema: https://legalcontextprotocol.org/standard/schema
- Examples: https://legalcontextprotocol.org/standard/examples
- Protocol integration: https://legalcontextprotocol.org/protocols
- White papers (foundational essays): https://legalcontextprotocol.org/papers
- Full specification (single document): https://legalcontextprotocol.org/llms-full.txt
- JSON Schema: https://legalcontextprotocol.org/schema/legal-context.schema.json
- GitHub: https://github.com/legal-context-protocol/legal-context-protocol
- License: Apache 2.0
- Version: 1.0 (Draft — released for community review)