Check a Site's Cookie Banner From ChatGPT, Claude or Cursor

The Model Context Protocol (MCP) is how AI assistants call external tools. CookieInspector exposes its scanner as an MCP server, so you can ask ChatGPT, Claude, Claude Code or Cursor to check a site's cookie banner and get the scanner's findings in the conversation, with a link to the full report.

There are two tiers, and the server tells the assistant which one it is in:

• Without an account: the same quick pre-scan the website offers. Headers and HTML of the home page, no browser. Enough to know which consent platform a site uses, what trackers it references and whether anything is set before consent.
• With an API key: the full scan with a real browser, before and after the consent click, up to five pages, with findings, evidence and the fix guide. Scans run on your account and count against your plan.

CookieInspector works alongside any consent platform (Cookiebot, OneTrust, Termly, CookieYes, Usercentrics and others): it checks what the banner actually blocks. Technical findings, not legal advice.

One URL, Streamable HTTP transport, no session state:

https://api.cookieinspector.com/mcp

Anonymous calls need no header. Account tools read a CookieInspector API key from the Authorization: Bearer header. You can create an API key in your account under Developers (Pro and Agency plans).

No account needed, no sign-in, within the quotas below.

• get_capabilities: what the server can do in the current tier, so the assistant explains the limits instead of guessing.
• prescan_site: start a pre-scan of a public website's home page. Returns an id and the link to the report on cookieinspector.com.
• get_prescan_result: the pre-scan result: risk score (0 best, 100 worst, the same scale as the full report), risk level, cookies before consent, up to five trackers by name, the consent platform and its confidence, Google Consent Mode status and three findings.
• explain_finding: what a finding code such as COOKIES_BEFORE_CONSENT means, which regulation it relates to and what to check, or what to verify in a named consent platform.

With an API key connected, the assistant can drive your account. Every lookup is limited to your own scans.

• start_scan: start a full scan, optionally from Germany or US West for geo-targeted banners. Uses your plan's monthly scans.
• get_scan_status: queued, running, completed or failed, with the risk score (0 best, 100 worst) once done.
• get_scan_summary: risk score, verdict, banner and consent platform, cookie and tracker counts, the top issues and the report link.
• get_scan_findings: the findings with severity, affected resource and recommendation, up to 25.
• list_scans: your most recent scans, newest first, each with its risk score.

Keys have read or write scope; start_scan needs write. A key is tied to your account and can be revoked at any time from the Developers page.

1. Open Settings, then Connectors. Under Advanced, turn on Developer mode (Plus, Pro, Team and Enterprise plans).
2. Choose Create, give it the name CookieInspector and paste the MCP server URL:

https://api.cookieinspector.com/mcp

3. Authentication: No authentication for the free tier.
4. In a chat, enable the connector from the tools menu and ask, for example, "check the cookie banner on example.com".

Account tools in ChatGPT need an API key sent as a Bearer token. Sign-in from ChatGPT with your CookieInspector account is coming next; until then, use Claude, Claude Code or Cursor for the account tools.

1. In claude.ai, open Settings, then Connectors, then Add custom connector.
2. Name it CookieInspector and paste the URL:

https://api.cookieinspector.com/mcp

3. Leave authentication empty for the free tier. Enable the connector in a chat and ask away.

From a terminal:

claude mcp add --transport http cookieinspector https://api.cookieinspector.com/mcp

With an API key, for the account tools:

claude mcp add --transport http cookieinspector https://api.cookieinspector.com/mcp \
  --header "Authorization: Bearer <your API key>"

Add the server to .cursor/mcp.json in your project, or to the global ~/.cursor/mcp.json. The headers block is only needed for the account tools:

{
  "mcpServers": {
    "cookieinspector": {
      "url": "https://api.cookieinspector.com/mcp",
      "headers": {
        "Authorization": "Bearer <your API key>"
      }
    }
  }
}

Any other MCP client that speaks Streamable HTTP works the same way: the URL, and optionally the header.

• Anonymous pre-scans: 10 per IP per hour, 500 per assistant per hour, 2,000 per day in total. When a quota is reached the tool says so and when to retry.
• Account tools: full scans use the plan's monthly scans, the same as scans started from the website or the API.
• Targets: public websites only. Private networks, localhost and the scanner's own infrastructure are refused.

Every result carries the same note: technical findings, not legal advice. The assistant is told to pass it on.