CookiePilot – cookie banner & Consent Mode v2

io.cookiepilot/cookiepilotcookiepilot.iostreamable-httpv1.0.0Scanned 1 hour ago

Add a GDPR cookie consent banner with Google Consent Mode v2 to any website, from the chat.

9 tools: 6 change things and 3 only read.

Reads private data · 1
Reads text others write · 6
Can send data out · 1
No findings

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

9 tools

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

add_domainAdds the website to the confirmed account (setup_token must be ready).No findings
Why it is in this group
- The name "add_domain" says "add": a word for a change.
Description, as the server wrote it
Adds the website to the confirmed account (setup_token must be ready). Defaults to the website given to create_account. An already added website is returned as is. The free plan includes one website.
Annotations the server declares
- title: Add the website to the user's CookiePilot account
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
configure_bannerSaves and publishes the banner look for a website on the confirmed account: colours (for example the suggested banner colours from a site analysis), position, layout, font and priv…No findings
Why it is in this group
- The description's first verb is "save": a word for a change.
Description, as the server wrote it
Saves and publishes the banner look for a website on the confirmed account: colours (for example the suggested banner colours from a site analysis), position, layout, font and privacy policy URL. Returns a preview link to the CookiePilot panel.
Annotations the server declares
- title: Configure the cookie banner
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_accountStarts a free CookiePilot sign-up for the user's own e-mail address and company, at the user's explicit request.Reads text others writeNo findings
Why it is in this group
- The name "create_account" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Starts a free CookiePilot sign-up for the user's own e-mail address and company, at the user's explicit request. CookiePilot e-mails a confirmation link to that address; no account exists until the address owner clicks it, sets a password and accepts the terms on CookiePilot's page. Returns a setup_token for the onboarding tools and a confirmation_code that the confirmation page also shows. The response is the same whether or not the address already has an account; an existing account holder receives a login link instead.
Annotations the server declares
- title: Create a CookiePilot account (needs e-mail confirmation)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
recommend_planRecommends the cheapest CookiePilot plan for the given monthly pageviews and number of domains, with current prices and limits of all plans, and a register link.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Recommends the cheapest CookiePilot plan for the given monthly pageviews and number of domains, with current prices and limits of all plans, and a register link. monthly_pageviews is the traffic the user states for their site.
Annotations the server declares
- title: Recommend a CookiePilot plan
- readOnlyHint: true
- openWorldHint: false
- idempotentHint: true
start_checkoutReturns a Stripe Checkout link for the Pro or Business plan on the confirmed account, for a user who chose a paid plan.Reads text others writeNo findings
Why it is in this group
- The name "start_checkout" says "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Returns a Stripe Checkout link for the Pro or Business plan on the confirmed account, for a user who chose a paid plan. Payment happens only on Stripe's page; the tool takes no card details.
Annotations the server declares
- title: Get a Stripe checkout link for a paid plan
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
verify_installationReports whether CookiePilot has seen its banner running on the website (verified) and, if not yet, whether the code is in the homepage HTML, with a hint for the user.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Reports whether CookiePilot has seen its banner running on the website (verified) and, if not yet, whether the code is in the homepage HTML, with a hint for the user.
Annotations the server declares
- title: Check whether the banner runs on the website
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true

Only reads 3Looks things up and changes nothing.Show 3 read-only tools

analyze_siteFetches the public homepage of a website (no JavaScript, public addresses only) and returns its brand colours, fonts, platform (WordPress, WooCommerce, PrestaShop, Shoper, Shopify……Reads text others writeCan send data outNo findings
Why it is in this group
- The name "analyze_site" says "analyze": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "fetch" and "website": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Fetches the public homepage of a website (no JavaScript, public addresses only) and returns its brand colours, fonts, platform (WordPress, WooCommerce, PrestaShop, Shoper, Shopify…), Google Tag Manager containers, consent tools already installed and detected trackers, plus suggested banner colours (WCAG-checked) and the recommended install method.
Annotations the server declares
- title: Analyze a website for a cookie banner
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
check_account_statusReturns pending_email (the user has not finished the confirmation page yet), ready (the account exists; the onboarding tools work with this setup_token for 24 hours) or expired.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "check_account_status" says "status": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Returns pending_email (the user has not finished the confirmation page yet), ready (the account exists; the onboarding tools work with this setup_token for 24 hours) or expired.
Annotations the server declares
- title: Check whether the user confirmed the account
- readOnlyHint: true
- openWorldHint: false
- idempotentHint: true
get_install_snippetStep-by-step install instructions for a platform — HTML code (Consent Mode stub + banner script), the WordPress/WooCommerce plugin, the PrestaShop module, Google Tag Manager or Sho…Reads text others writeNo findings
Why it is in this group
- The name "get_install_snippet" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "html": it reads web pages, which anyone can write.
Description, as the server wrote it
Step-by-step install instructions for a platform — HTML code (Consent Mode stub + banner script), the WordPress/WooCommerce plugin, the PrestaShop module, Google Tag Manager or Shoper. With a ready setup_token the code contains the real key of the account's domain; without it, YOUR_API_KEY is a placeholder and a register link is included.
Annotations the server declares
- title: Get CookiePilot install instructions
- readOnlyHint: true
- openWorldHint: false
- idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

6 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; check_account_status
Reads text others write6: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; analyze_site
check_account_status
create_account
get_install_snippet
start_checkout
verify_installation
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; analyze_site

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__cookiepilot__analyze_site"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http cookiepilot https://mcp.cookiepilot.io/mcp

claude mcp add --transport http cookiepilot https://mcp.cookiepilot.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__cookiepilot__get_install_snippet",
      "mcp__cookiepilot__check_account_status"
    ],
    "ask": [
      "mcp__cookiepilot__analyze_site",
      "mcp__cookiepilot__recommend_plan",
      "mcp__cookiepilot__create_account",
      "mcp__cookiepilot__add_domain",
      "mcp__cookiepilot__configure_banner",
      "mcp__cookiepilot__verify_installation",
      "mcp__cookiepilot__start_checkout"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cookiepilot. Review it before you use it.

Capability tags behind 6 rules

mcp__cookiepilot__analyze_site untrusted-input, outbound
mcp__cookiepilot__get_install_snippet untrusted-input
mcp__cookiepilot__create_account untrusted-input
mcp__cookiepilot__check_account_status private-data, untrusted-input
mcp__cookiepilot__verify_installation untrusted-input
mcp__cookiepilot__start_checkout untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.cookiepilot/cookiepilot/verify?hash=9e5b4077c0ce253c56876d040f5c753dcfdd26f1ede9ab37dc8f069e1afffeb0" | jq -e '.changed == false'

Pinned hash 9e5b4077c0ce, from Oct 31, 2026, 11:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.cookiepilot/cookiepilot/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.cookiepilot/cookiepilot.svg)](https://anlyon.dev/servers/io.cookiepilot/cookiepilot)

Source: MCP Registry. Synced Oct 31, 2026, 11:17 UTC.