CookieInspector

by cookieinspector.com · remote · no sign-in to list tools · v1.0.0 · published by com.cookieinspector

Check what a site's cookie banner really blocks: CMP, trackers, cookies before consent.

Changes · 3

Compare Registry entry

9 tools: 3 change things and 6 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things3Claude Code: ask: see these tools
Only reads6Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http cookieinspector https://api.cookieinspector.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnexplain_finding
The server marks "explain_finding" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "explain_finding" says "explain": a word for reading.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Changes things 3Creates or changes something that can be changed back.Claude Code: ask

explain_findingExplain a CookieInspector finding code (e.g.1 finding
Why it is in this group
- The name "explain_finding" says "explain": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "explain_finding" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "explain_finding" says "explain": a word for reading.
  What this check looks for
Description, as the server wrote it
Explain a CookieInspector finding code (e.g. THIRD_PARTY_PRE_CONSENT) or what to check in a named consent platform (e.g. Cookiebot). No network call. Technical findings, not legal advice.
Annotations the server declares
- title: Explain a finding or a consent platform
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
prescan_siteStart a quick, anonymous pre-scan of a public website's home page: HTTP headers and HTML only, no real browser.No findings
Why it is in this group
- The description's first verb is "start": a word for a change.
Description, as the server wrote it
Start a quick, anonymous pre-scan of a public website's home page: HTTP headers and HTML only, no real browser. Returns a preScanId to pass to get_prescan_result and a link to the report on cookieinspector.com. CookieInspector works alongside any consent platform; it checks what the banner actually does. Technical findings, not legal advice.
Annotations the server declares
- title: Quick pre-scan of a website
- destructiveHint: false
- idempotentHint: false
- readOnlyHint: false
start_scanStart a full CookieInspector scan with a real browser (before and after the consent click, up to 5 pages) on the connected account.No findings
Why it is in this group
- The name "start_scan" says "start": a word for a change.
Description, as the server wrote it
Start a full CookieInspector scan with a real browser (before and after the consent click, up to 5 pages) on the connected account. Optional region: main (US East), us-west, eu-de (Germany, for EU-targeted banners). Uses the plan's monthly scans. Returns a scanId to poll with get_scan_status, then get_scan_summary. Technical findings, not legal advice.
Annotations the server declares
- title: Start a full scan
- destructiveHint: false
- idempotentHint: false
- readOnlyHint: false

Only reads 6Looks things up and changes nothing.Claude Code: allow

get_capabilitiesDescribe what CookieInspector checks on a website (cookies and trackers before and after the consent click, banner behaviour, consent platform, Google Consent Mode), which tools wo…No findings
Why it is in this group
- The name "get_capabilities" says "get": a word for reading.
Description, as the server wrote it
Describe what CookieInspector checks on a website (cookies and trackers before and after the consent click, banner behaviour, consent platform, Google Consent Mode), which tools work without an account, which need a CookieInspector API key, and the quotas. Call this first when unsure which tool to use. Technical findings, not legal advice.
Annotations the server declares
- title: What CookieInspector can do here
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
get_prescan_resultReturn the result of a pre-scan started with prescan_site: riskScore (0 best, 100 worst, the same scale as the full report), risk level, how many cookies load before consent, up to…No findings
Why it is in this group
- The name "get_prescan_result" says "get": a word for reading.
Description, as the server wrote it
Return the result of a pre-scan started with prescan_site: riskScore (0 best, 100 worst, the same scale as the full report), risk level, how many cookies load before consent, up to five trackers by name, the consent platform and its confidence, Google Consent Mode status, three findings, and the report link. This is a header-and-HTML pre-scan, single page; the full scan with a real browser, evidence and fix guide requires a CookieInspector account. Technical findings, not legal advice.
Annotations the server declares
- title: Pre-scan result
- destructiveHint: false
- idempotentHint: true
- readOnlyHint: true
get_scan_findingsThe findings of a scan on the connected account, with severity, the affected resource and the recommendation, up to 25.No findings
Why it is in this group
- The name "get_scan_findings" says "get": a word for reading.
Description, as the server wrote it
The findings of a scan on the connected account, with severity, the affected resource and the recommendation, up to 25. Use explain_finding for what a code means. Technical findings, not legal advice.
Annotations the server declares
- title: Scan findings
- destructiveHint: false
- idempotentHint: true
- readOnlyHint: true
get_scan_statusStatus of a scan on the connected account: queued, running, completed or failed, with the riskScore (0 best, 100 worst) once done.No findings
Why it is in this group
- The name "get_scan_status" says "get": a word for reading.
Description, as the server wrote it
Status of a scan on the connected account: queued, running, completed or failed, with the riskScore (0 best, 100 worst) once done. Technical findings, not legal advice.
Annotations the server declares
- title: Scan status
- destructiveHint: false
- idempotentHint: true
- readOnlyHint: true
get_scan_summarySummary of a completed scan on the connected account: risk score (0 best, 100 worst), verdict, banner and consent platform, cookie and tracker counts, the top issues and the report…No findings
Why it is in this group
- The name "get_scan_summary" says "get": a word for reading.
Description, as the server wrote it
Summary of a completed scan on the connected account: risk score (0 best, 100 worst), verdict, banner and consent platform, cookie and tracker counts, the top issues and the report link. Technical findings, not legal advice.
Annotations the server declares
- title: Scan summary
- destructiveHint: false
- idempotentHint: true
- readOnlyHint: true
list_scansThe most recent scans on the connected account, newest first (up to 20), each with its riskScore (0 best, 100 worst).No findings
Why it is in this group
- The name "list_scans" says "list": a word for reading.
Description, as the server wrote it
The most recent scans on the connected account, newest first (up to 20), each with its riskScore (0 best, 100 worst). Technical findings, not legal advice.
Annotations the server declares
- title: List recent scans
- destructiveHint: false
- idempotentHint: true
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http cookieinspector https://api.cookieinspector.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__cookieinspector__get_scan_summary",
      "mcp__cookieinspector__get_scan_status",
      "mcp__cookieinspector__get_prescan_result",
      "mcp__cookieinspector__get_capabilities",
      "mcp__cookieinspector__list_scans",
      "mcp__cookieinspector__get_scan_findings"
    ],
    "ask": [
      "mcp__cookieinspector__start_scan",
      "mcp__cookieinspector__explain_finding",
      "mcp__cookieinspector__prescan_site"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as cookieinspector. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.cookieinspector/cookieinspector/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 17:53 UTC.

For agents: Markdown · JSON · report this listing