Audits websites for cookie consent compliance across major privacy frameworks. Point it at any URL and get a structured PASS/FAIL checklist with regulatory citations and fix recommendations — no browser, no manual inspection required.
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Average 4.5/5 across 6 of 6 tools scored.
Each tool has a clearly distinct purpose: starting a scan, polling status, retrieving reports, listing history, focusing on failures, and purchasing credits. No two tools overlap in functionality.
All tool names follow a consistent verb_noun pattern (scan_url, get_scan_status, get_scan_report, get_failing_checks, list_my_scans, get_payment_link) using snake_case, making them predictable and easy to navigate.
With 6 tools, the set is well-scoped for a cookie consent compliance analyser. It covers the complete scan lifecycle (initiate, poll, retrieve results) plus history and payment, without unnecessary clutter.
The tool surface covers the primary workflow: scanning, status polling, full report, failing checks, history, and payment. Minor gaps exist (e.g., no delete or rescan), but the core compliance analysis task is fully supported.
get_failing_checksAReturn only the FAIL and PARTIAL checks from a completed scan.
This is the most useful tool for an agent writing a compliance summary or remediation plan — it omits all the passing checks and focuses entirely on what needs to be fixed, with actionable recommendations for each issue.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The 8-character run_id returned by scan_url. |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, idempotentHint, destructiveHint. Description adds that it omits passing checks and focuses on actionable recommendations, providing useful context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences front-loaded with purpose and value. Every sentence earns its place with no waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With output schema present, description does not need to explain return values. It is complete and sufficient given the tool's simplicity and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter. Description does not add additional meaning beyond what the schema already provides, so baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns FAIL and PARTIAL checks from a completed scan, with specific verb+resource. It distinguishes from sibling tools like get_scan_report by focusing on actionable items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says this tool is for writing compliance summaries or remediation plans, implying when to use it. However, it does not explicitly state when not to use it or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_payment_linkAInspectGet a Stripe payment link to buy 50 scan credits for $5.
Returns a URL that the user should open in their browser to complete the payment. Credits are added to their account automatically once payment is confirmed — usually within a few seconds.
Requires a valid bearer token (anonymous callers cannot purchase).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| url | Yes | Stripe Checkout URL. Open this in a browser to complete payment. |
| credits | Yes | Number of scan credits included in this purchase. |
| message | Yes | Human-readable instruction to share with the user. |
| price_usd | Yes | Price in USD. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes the return type (URL), post-payment behavior (automatic credit addition within seconds), and authentication requirement, adding value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences convey purpose, result, and prerequisites efficiently, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and an output schema, the description fully explains what the tool does and its requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline 4 applies. No need for additional parameter description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool creates a Stripe payment link to buy 50 scan credits for $5, distinguishing it from sibling tools that handle scanning and reports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly requires a valid bearer token, indicating when use is appropriate. While no explicit alternatives are given, the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_reportARetrieve the compliance report for a completed scan.
Always call get_scan_status first to confirm done=True. For a focused
view of what needs fixing, prefer get_failing_checks instead.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The 8-character run_id returned by scan_url. | |
| summary_only | No | If True, return only the headline score and per-check PASS/FAIL list without verbose detail. Useful for a quick overview or when token budget is limited. Default false (full report). |
| Name | Required | Description |
|---|---|---|
| url | Yes | Scanned URL. |
| mode | Yes | Compliance framework used. |
| score | No | Overall compliance score 0–100 (summary mode). |
| checks | No | Per-check PASS/FAIL list (summary mode). |
| report | No | Complete report object including full checklist, score, metadata, and AI narrative (full mode). |
| run_id | Yes | 8-character scan identifier. |
| started_at | Yes | ISO 8601 timestamp when the scan started. |
| score_label | No | Score band e.g. 'Good', 'Needs Work', 'Critical' (summary mode). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. Description adds the behavioral constraint that the scan must be completed, which is useful context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences: purpose, prerequisite, alternative. Each sentence is essential and front-loaded. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists, annotations safe, and schema covers parameters, the description is complete except for not handling invalid run_id or scan-failure cases, but that's minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with adequate descriptions for both parameters. The description itself adds no parameter details, so baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it retrieves the compliance report for a completed scan. Distinguishes from sibling get_failing_checks by noting it's a full report whereas the sibling is for a focused view.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises calling get_scan_status first to confirm completion, and recommends get_failing_checks for a narrower focus. Provides clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_statusACheck whether a scan is still running.
Poll this every 10–15 seconds after calling scan_url. When done=True,
call get_scan_report or get_failing_checks to retrieve results.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The 8-character run_id returned by scan_url. |
| Name | Required | Description |
|---|---|---|
| done | Yes | True when the scan has finished (success or failure). |
| note | No | Human-readable note when the run is not found. |
| failed | No | True if the scan failed or was not found (present when done). |
| cancelled | No | True if the scan was cancelled (present when done). |
| c3_available | No | True if a C3 HTML detail report is available (present when done successfully). |
| current_step | No | Most recent progress message (present while running). |
| elapsed_seconds | No | Seconds elapsed since scan started (present while running). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive. Description adds polling frequency and next-step triggers, providing useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with purpose, immediate usage guidance. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only one parameter, high schema coverage, and an output schema assumed present, the description covers the essential flow. It mentions the done flag and next steps, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with run_id described as 'The 8-character run_id returned by scan_url'. Description reinforces the origin but adds no new semantic details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks scan status, with specific verb 'Check' and resource 'scan status'. It distinguishes from siblings by directing to get_scan_report or get_failing_checks when done.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to poll every 10–15 seconds after calling scan_url, and guides when to use alternatives based on done=True condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_my_scansAList your recent scans (or recent public scans if anonymous).
Returns scans ordered most-recent first. Use the run_id from any row
to retrieve the full report with get_scan_report or get_failing_checks.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of scans to return. Must be between 1 and 100. Default 20. |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and idempotent behavior. The description adds valuable context: scans are 'recent', ordered 'most-recent first', and public scans are shown when anonymous. This clarifies the scope and ordering beyond the annotation's safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, each providing essential information: what the tool lists and how to use the results. No unnecessary words, and the most important action is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple interface (one well-documented parameter, strong annotations, and an output schema available), the description covers the tool's purpose, scope, ordering, and integration with sibling tools. No gaps remain for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'limit' is fully described in the input schema (type, default, range, description). The description does not repeat or add extra semantics for the parameter, which is acceptable given 100% schema coverage. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the verb 'list' and specifies the resource 'your recent scans' (or public scans if anonymous), clearly distinguishing this from siblings like get_scan_report which retrieve full reports. It directly states what the tool does and how results relate to other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using run_id from this tool to retrieve full reports via get_scan_report or get_failing_checks, providing clear context for when to use this listing tool versus its siblings. It doesn't explicitly state when not to use it, but the purpose is well-defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_urlAInspectStart a cookie consent compliance scan on the given URL.
The scan runs asynchronously in the background. This tool returns a
run_id immediately — the actual scan takes 60–120 seconds. Use
get_scan_status(run_id) to poll for completion, then call
get_scan_report(run_id) or get_failing_checks(run_id).
If login_username and login_password are supplied, a paired scan is run:
one scan before login and one after, linked by a scan_group_id. The
returned run_id is for the pre-login scan. Only one credit is consumed.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The website URL to scan, e.g. 'https://example.com'. HTTP is accepted and upgraded to HTTPS automatically. | |
| mode | No | Compliance framework to audit against: 'gdpr' (GDPR/ePrivacy, default), 'ccpa' (US/CCPA), or 'gcm' (Google Consent Mode v2). | gdpr |
| region | No | Geographic location of the probe browser: 'eu' (European IP, default) or 'us' (US IP via proxy). Use 'eu' unless you specifically need a US perspective. | eu |
| login_url | No | Optional. URL of the login page. If omitted, the scan target URL is used as the login page. | |
| ai_enhanced | No | Enable Claude AI narrative analysis layered on top of the automated checklist. Produces richer recommendations but takes longer and consumes Claude API credits. Default false. | |
| login_password | No | Optional. Password for the login_username. Required if login_username is provided. | |
| login_username | No | Optional. Username or email address to log in to the site before scanning. When provided together with login_password, two linked scans are run: one before login and one after. Only one credit is consumed. |
| Name | Required | Description |
|---|---|---|
| url | Yes | The normalised URL being scanned. |
| mode | Yes | Compliance framework in use: 'gdpr', 'ccpa', or 'gcm'. |
| note | Yes | Reminder to poll get_scan_status every 10–15 s. |
| region | Yes | Probe region: 'eu' or 'us'. |
| run_id | Yes | 8-character identifier for this scan run. Pass to get_scan_status / get_scan_report. |
| status | Yes | Always 'started'. |
| paired_run_id | No | Present only for paired scans. The run_id of the complementary (post-login) scan. |
| scan_group_id | No | Present only for paired pre/post-login scans. Links the two runs together. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant context beyond annotations: async operation, 60–120 second duration, immediate return of run_id, paired scan behavior, credit consumption. Annotations indicate non-read-only and open world, which are consistent and enriched by the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and concise, with two clear paragraphs. The first paragraph covers the main purpose and async flow, the second covers paired scan logic. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, async behavior, paired scans), the description covers all necessary aspects: when to use, how to poll, parameter details, and edge cases. An output schema exists, and description complements it well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but description adds valuable meaning: URL format explanation, mode compliance frameworks, region geographic intent, login parameters for paired scans. This significantly helps an agent choose correct parameter values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Start a cookie consent compliance scan on the given URL.' This is a specific verb+resource combination. It clearly distinguishes from sibling tools like get_scan_status, get_scan_report, and get_failing_checks, which are for retrieving results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use this tool versus alternatives. It explicitly instructs to use get_scan_status for polling and get_scan_report or get_failing_checks for results. It also explains the paired scan scenario with login credentials.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
No comments yet. Be the first to start the discussion!
