cookie-consent

Name: cookie-consent
Author: consentstack

Set up and run GDPR and CCPA cookie consent from your AI agent.

CommunityOnlineNo sign-inGlobalFreeCan modify data

What it can do

List Sites: List every team the authenticated user belongs to and the sites in each, with the user's role and each site's plan. Call this first to find the teamSlug and siteSlug other tools require.
Get Site Overview: Orientation for one site: plan and full entitlement matrix (which features the plan allows, with upgrade hints for gated ones), MAU usage vs cap, domains and verification status, pe
Get Config: Read the site's consent configuration. view=published (default) returns what is live; view=draft overlays any pending unpublished section drafts. Optionally narrow to one section: appearan

What data it sees

Do you need an account

No: the server works without sign-in

Set up and run GDPR and CCPA cookie consent from your AI agent. Create a site, publish a cookie banner, get the install snippet, run a compliance scan, and categorize the trackers it finds, all without leaving the conversation.

ConsentStack is a hosted consent management platform (CMP). This server exposes 22 tools covering the full job, so the same assistant that built your site can put working cookie consent on it.

Quick start

Claude Code:

claude mcp add --transport http consentstack https://app.consentstack.io/api/mcp

Cursor, or any client that supports remote MCP over streamable HTTP:

{
  "mcpServers": {
    "consentstack": {
      "url": "https://app.consentstack.io/api/mcp"
    }
  }
}

Authentication is OAuth 2.1. On first connect your client opens a browser window and you sign in with your ConsentStack account. There are no API keys to create or paste. Full setup instructions live in the MCP server documentation.

What your agent can do

Job	Tools
Sites and setup	`list_sites`, `get_site_overview`, `create_site`, `manage_domains`, `get_setup_guide`
Cookie banner configuration	`get_config`, `update_appearance`, `update_content`, `update_compliance`, `update_settings`, `publish_config`, `discard_draft`
Trackers and script blocking	`list_detected_trackers`, `set_tracker_category`, `clear_tracker_override`, `set_hostname_policy`
Compliance scanning	`start_scan`, `get_scan_result`
Consent analytics and logs	`get_consent_analytics`, `get_consent_logs`
Documentation	`search_docs`, `get_doc`

A typical end-to-end run

Create. create_site adds a site on the free Basic tier. manage_domains registers the domains it runs on.
Install. get_setup_guide returns the install tags with your real site key already filled in, ready to paste into your ``.
Configure. Banner appearance, copy, compliance rules, and behavior settings are staged as drafts. Drafts never touch the live site, so your agent can propose a complete cookie banner and you approve it before anything ships.
Publish. publish_config pushes the staged changes live.
Verify. start_scan runs a compliance scan and get_scan_result returns the findings. Each finding names the tool that fixes it, so the agent can categorize the offending tracker and rescan to confirm.

Because every write is staged as a draft and publishing is a separate, explicit step, an agent cannot silently change what visitors see on your production site.

About ConsentStack

ConsentStack blocks tracking scripts before they load, categorizes the trackers it detects, and signals consent to downstream tools through Google Consent Mode v2 and native integrations for Meta, Microsoft, LinkedIn, TikTok, Pinterest, HubSpot, and Shopify. GDPR, CCPA, and the other US state privacy laws are handled by region, so visitors see the banner behavior their jurisdiction requires.

The Basic tier is free and covers 1,000 unique monthly visitors. See plans and pricing for higher traffic tiers, or run the free compliance scanner against your site to see what is firing before consent today.

If you built your site with an AI tool, this is the shortest path to a working cookie banner: the assistant that built the site installs consent on it.

Server tool list (22)

Raw names from tools/list. Only developers need these.

list_sites	List every team the authenticated user belongs to and the sites in each, with the user's role and each site's plan. Call this first to find the teamSlug and siteSlug other tools require.
get_site_overview	Orientation for one site: plan and full entitlement matrix (which features the plan allows, with upgrade hints for gated ones), MAU usage vs cap, domains and verification status, pending config drafts per section, published config version, and setup checklist. Call this before configuring so you design within the site's plan limits.
get_config	Read the site's consent configuration. view=published (default) returns what is live; view=draft overlays any pending unpublished section drafts. Optionally narrow to one section: appearance, content, categories, or settings.
update_appearance	Stage appearance changes (layout, colors, fonts, spacing, customCss, customJs) as a draft. Partial patch: include only fields to change. Nested objects deep-merge over the current draft (or published config if no draft exists). Arrays replace wholesale, so send the complete array when changing one. The merged section is fully re-validated. Read the current values with get_config section=appearance first. Custom CSS and JS are plan-gated, check get_site_overview entitlements. Nothing goes live until publish_config.
update_content	Stage banner and preferences copy changes (titles, descriptions, button labels, links, per-consent-model overrides) as a draft. Partial patch: include only fields to change. Nested objects deep-merge over the current draft (or published config if no draft exists). Arrays replace wholesale, so send the complete array when changing one. The merged section is fully re-validated. Read current values with get_config section=content first. Nothing goes live until publish_config.
update_compliance	Stage compliance changes as a draft: consent categories, regions, consent rules (which consent model applies per category and region), language configuration, the global compliance flag, and surface visibility. This is the "categories" config section. Surface visibility is bannerVisibility, reentryVisibility (arrays of consent models, each a prefix of ["opt_in","opt_out","notice","notice_required"]; [] means the surface never shows). Partial patch: include only fields to change. Nested objects deep-merge over the current draft (or published config if no draft exists). Arrays replace wholesale, so send the complete array when changing one. The merged section is fully re-validated. categories, regions, consentRules, and the two visibility lists are arrays and replace wholesale, fetch them with get_config section=categories, modify, and send the complete arrays. Enabling more than one language is plan-gated (multiLanguage). Nothing goes live until publish_config.
update_settings	Stage behavior toggle changes as a draft: geoDetectionEnabled, crossDomainConsent, consentTtlDays (1 to 3650 or null), strictFallbackEnabled, disableConfigCaching, showBranding (turning branding off is plan-gated), exposeGeoDetails, gpcMode ("always" honors GPC signals everywhere - the default, "required_only" honors only where statutorily required, "off" disables automatic GPC handling). testMode (when true, real visitors see no banner and nothing is blocked, but tracker detection and visitor counts keep working. Add ?cs-test-mode=true to a page load to see the banner yourself, for pre-launch validation). Whether the banner and the preferences button appear is no longer set here, it is bannerVisibility / reentryVisibility on update_compliance. Partial patch: include only fields to change. Nested objects deep-merge over the current draft (or published config if no draft exists). Arrays replace wholesale, so send the complete array when changing one. The merged section is fully re-validated. Nothing goes live until publish_config.
publish_config	Publish pending config drafts, making them live for real site visitors. IMPORTANT: before calling this, summarize every pending change to the user in plain language and get their explicit go-ahead in this conversation. Publishes all pending section drafts unless sections narrows the set. Config regeneration and automatic translation run after publish.
discard_draft	Delete one section's pending draft without publishing it. The live config is unaffected. Confirm with the user before discarding work they may want.
list_detected_trackers	Inventory of trackers the SDK has observed on this site: catalog products (with vendor, default category, the effective category after any manual override, script domains, cookie counts), script domains not matched to the catalog, free-standing manual rules, hostname ignore/block lists, and the valid category ids for set_tracker_category.
set_tracker_category	Categorize a tracker so the SDK gates it behind consent for that category. Target a catalog product by productId (rules are written for every domain pattern of the product) or a single hostname pattern by domainPattern. This is the fix for scan findings where a tracker fired after reject (leaky) or before consent (pre_fence). Category must be one of the site's category ids (see list_detected_trackers). Requires admin or owner role.
clear_tracker_override	Remove the manual category rules for a catalog product (by productId) or a single pattern (by domainPattern). The tracker falls back to its catalog default category. Requires admin or owner role.
set_hostname_policy	Set a per-hostname policy: ignore (always allow, never gate; for trusted first-party hosts), block (always block regardless of consent), or clear (remove the hostname from both lists). The two lists are mutually exclusive. Requires admin or owner role.
create_site	Create a new site in an existing team on the Basic tier (free, no billing step). Optionally seed the first domain. Returns the site slug and public site key for the install snippet. Plan upgrades happen in the dashboard. Requires admin or owner role.
manage_domains	Manage the site's domains. Actions: list (all domains with verification status), add, remove, set_primary, check (re-read one domain's verification status). Verification is automatic, there is no DNS or meta-tag challenge: the domain verifies when the consent snippet first loads on it. Domain limits are plan-based; add returns a plan_gate error at the limit. Requires admin or owner role.
start_scan	Scan one of this site's verified domains for consent compliance (EU and US visits, tracker and cookie behavior before and after consent choices). Defaults to the primary verified domain; pass domain to scan another verified domain. Budget: 5 scans per site per hour. Returns a scanId to poll with get_scan_result. Requires admin or owner role.
get_scan_result	Status and structured verdict for a scan started with start_scan: overall score, per-regulation status, and per-region (EU, US) verdict, findings with remediation hints naming the MCP tools that fix them, and tracker and cookie outcomes.
get_consent_analytics	Aggregated consent analytics for a site: KPIs (total events, impressions, consent rate, average time to action), daily or hourly trend, per-category acceptance rates, action breakdown (accept all, reject all, partial, acknowledge), device and country breakdowns. range: 24h, 7d, 30d (default), 90d. Plan-gated: available on Pro and Business.
get_consent_logs	Paginated consent decision records for a site, newest first: event type and action, categories chosen, regulation and region, device, page, timing. limit 1 to 100 (default 25), offset for paging. totalCount is exact under 10k rows and a fast estimate above. Plan-gated: available on Pro and Business.
search_docs	Keyword-search the ConsentStack documentation. Returns matching pages with title, url, and a snippet. Use get_doc with the doc slug (path after /docs/) to read a full page.
get_doc	Fetch one ConsentStack documentation page as markdown by its slug, e.g. 'developers/javascript-api' or 'concepts/script-blocking'.
get_setup_guide	Platform-specific ConsentStack install guide with this site's real site key already substituted into the snippet. Returns ready-to-paste markdown. Platforms: generic, nextjs, react, wordpress, shopify, webflow, squarespace, wix, finsweet.