Cookie consent scanner: GDPR, CCPA, GCMv2. PASS/FAIL compliance checklists with fix recommendations.
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Average 4.5/5 across 6 of 6 tools scored.
Each tool has a distinct purpose: scan initiation, status polling, full report, failing checks, history listing, and payment. No functional overlap.
All tool names follow a clear verb_noun pattern (e.g., scan_url, get_scan_status, get_scan_report) with no mixing of conventions.
Six tools cover the full scanning workflow without bloat or gaps: start, poll, retrieve, list, and buy credits.
The set covers the entire scan lifecycle from initiation to reporting, including a payment tool for credits. No obvious missing operations.
get_failing_checksAReturn only the FAIL and PARTIAL checks from a completed scan.
This is the most useful tool for an agent writing a compliance summary or remediation plan — it omits all the passing checks and focuses entirely on what needs to be fixed, with actionable recommendations for each issue.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The 8-character run_id returned by scan_url. |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, non-destructive traits. The description adds useful behavioral context: it requires a 'completed scan,' filters to FAIL/PARTIAL checks, and includes actionable recommendations—none of which are redundant with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only three sentences, with the core action front-loaded. Every sentence adds value: the first states what it does, the second states when to use it and what it omits, and the third highlights actionability. No fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (1 parameter, fully documented in schema), and an output schema is present, so return details need not be in the description. The description provides sufficient context for an agent to decide when to use it and what to expect, given its scope and behavioral notes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully describes the only parameter run_id ('The 8-character run_id returned by scan_url'), so schema coverage is 100%. The description does not add parameter details, but this is appropriate when the schema is already self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb phrase 'Return only the FAIL and PARTIAL checks from a completed scan,' clearly identifying the resource and scope. It distinguishes from siblings by emphasizing that it omits passing checks, making it the definitive tool for remediation-focused questions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool: when writing a compliance summary or remediation plan. It also implies when not to use it via 'it omits all the passing checks,' though it does not name sibling alternatives like get_scan_report.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_payment_linkAInspectGet a Stripe payment link to buy 50 scan credits for $5.
Returns a URL that the user should open in their browser to complete the payment. Credits are added to their account automatically once payment is confirmed — usually within a few seconds.
Requires a valid bearer token (anonymous callers cannot purchase).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| url | Yes | Stripe Checkout URL. Open this in a browser to complete payment. |
| credits | Yes | Number of scan credits included in this purchase. |
| message | Yes | Human-readable instruction to share with the user. |
| price_usd | Yes | Price in USD. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description transparently discloses key behaviors beyond the annotations: it returns a URL that the user must open, credits are added automatically after payment, and it requires authentication. This gives the agent a clear picture of the tool's side effects and constraints, with no contradiction to the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the main purpose, followed by the return value and the authentication requirement. Every sentence earns its place with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no params) and the presence of an output schema, the description is complete: it explains what the tool does, what it returns, the post-payment behavior, and the auth requirement. It fully equips the agent to decide when and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds no parameter-specific info, but none is needed since the operation is fixed (50 credits for $5). The schema already covers 100% of parameters (none), so no gap exists.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's function: 'Get a Stripe payment link to buy 50 scan credits for $5.' This is a specific verb ('Get') with a clear resource (payment link) and purpose (buy credits), and it clearly distinguishes itself from sibling tools which are all scan-related reads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: when the user needs to purchase scan credits. It also mentions a prerequisite ('Requires a valid bearer token'). However, it does not explicitly exclude alternatives or name other tools, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_reportARetrieve the compliance report for a completed scan.
Always call get_scan_status first to confirm done=True. For a focused
view of what needs fixing, prefer get_failing_checks instead.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The 8-character run_id returned by scan_url. | |
| summary_only | No | If True, return only the headline score and per-check PASS/FAIL list without verbose detail. Useful for a quick overview or when token budget is limited. Default false (full report). |
| Name | Required | Description |
|---|---|---|
| url | Yes | Scanned URL. |
| mode | Yes | Compliance framework used. |
| score | No | Overall compliance score 0–100 (summary mode). |
| checks | No | Per-check PASS/FAIL list (summary mode). |
| report | No | Complete report object including full checklist, score, metadata, and AI narrative (full mode). |
| run_id | Yes | 8-character scan identifier. |
| started_at | Yes | ISO 8601 timestamp when the scan started. |
| score_label | No | Score band e.g. 'Good', 'Needs Work', 'Critical' (summary mode). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds valuable behavioral context: the tool should only be called for completed scans and requires a status check first. This goes beyond the annotations and is well-articulated, though not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the primary purpose, and every sentence earns its place. It delivers high-value guidance without unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two parameters, rich annotations, an output schema, and a low-complexity structure, the description provides all necessary context: purpose, prerequisites, and alternatives. It is complete for an agent to invoke successfully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and parameter descriptions in the schema are detailed, especially for summary_only. The description adds an important constraint on run_id by requiring the scan to be completed, which is not explicitly in the schema. This extra semantic guidance justifies slightly above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the compliance report for a completed scan, using a specific verb and resource. It also distinguishes itself from the sibling get_failing_checks by directing users there for a focused view, and from get_scan_status by requiring it to be called first.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is provided: always call get_scan_status first to confirm done=True, and prefer get_failing_checks for a focused view. This clearly states when to use the tool and identifies an alternative, satisfying the dimension fully.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_statusACheck whether a scan is still running.
Poll this every 10–15 seconds after calling scan_url. When done=True,
call get_scan_report or get_failing_checks to retrieve results.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The 8-character run_id returned by scan_url. |
| Name | Required | Description |
|---|---|---|
| done | Yes | True when the scan has finished (success or failure). |
| note | No | Human-readable note when the run is not found. |
| failed | No | True if the scan failed or was not found (present when done). |
| cancelled | No | True if the scan was cancelled (present when done). |
| c3_available | No | True if a C3 HTML detail report is available (present when done successfully). |
| current_step | No | Most recent progress message (present while running). |
| elapsed_seconds | No | Seconds elapsed since scan started (present while running). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable operational context (poll interval and the done=True signal) that goes beyond the annotations, without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short, purposeful sentences. It front-loads the main purpose and wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter polling tool with an output schema and rich annotations (read-only, idempotent), the description fully covers when to use it, how often to poll, and what to do next. Nothing important is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully documents the run_id parameter as 'The 8-character run_id returned by scan_url.' The description only indirectly references run_id via 'after calling scan_url,' so it adds little beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear, specific statement: 'Check whether a scan is still running.' It uses a specific verb and resource, and distinguishes itself from sibling tools by directing the agent to call get_scan_report or get_failing_checks when done=True.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage guidance is explicit: 'Poll this every 10–15 seconds after calling scan_url' gives a concrete cadence, and 'When done=True, call get_scan_report or get_failing_checks' clearly tells when to use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_my_scansAList your recent scans (or recent public scans if anonymous).
Returns scans ordered most-recent first. Use the run_id from any row
to retrieve the full report with get_scan_report or get_failing_checks.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of scans to return. Must be between 1 and 100. Default 20. |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly and idempotent behavior. The description adds ordering (most-recent first), anonymous handling (public scans), and the presence of run_id in results, offering useful behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences: the first states the action and anonymous variant, the second covers ordering and follow-up. Every word earns its place, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one optional parameter and an output schema, the description sufficiently covers purpose, ordering, anonymous behavior, and post-list actions. An agent can confidently invoke it without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'limit' is fully described in the schema with a default and range. The description does not add any semantic nuance beyond what the schema already provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists recent scans, with an explicit verb and resource. It distinguishes itself from sibling tools by noting the follow-up action using run_id to retrieve reports/checks, making its role in the workflow clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage context: use this to list scans, then use run_id with get_scan_report or get_failing_checks. It also mentions anonymous behavior. However, it does not explicitly contrast with alternatives like get_scan_status, though the workflow implication is present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_urlAInspectStart a cookie consent compliance scan on the given URL.
The scan runs asynchronously in the background. This tool returns a
run_id immediately — the actual scan takes 60–120 seconds. Use
get_scan_status(run_id) to poll for completion, then call
get_scan_report(run_id) or get_failing_checks(run_id).
If login_username and login_password are supplied, a paired scan is run:
one scan before login and one after, linked by a scan_group_id. The
returned run_id is for the pre-login scan. Only one credit is consumed.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The website URL to scan, e.g. 'https://example.com'. HTTP is accepted and upgraded to HTTPS automatically. | |
| mode | No | Compliance framework to audit against: 'gdpr' (GDPR/ePrivacy, default), 'ccpa' (US/CCPA), or 'gcm' (Google Consent Mode v2). | gdpr |
| region | No | Geographic location of the probe browser: 'eu' (European IP, default) or 'us' (US IP via proxy). Use 'eu' unless you specifically need a US perspective. | eu |
| login_url | No | Optional. URL of the login page. If omitted, the scan target URL is used as the login page. | |
| ai_enhanced | No | Enable Claude AI narrative analysis layered on top of the automated checklist. Produces richer recommendations but takes longer and consumes Claude API credits. Default false. | |
| login_password | No | Optional. Password for the login_username. Required if login_username is provided. | |
| login_username | No | Optional. Username or email address to log in to the site before scanning. When provided together with login_password, two linked scans are run: one before login and one after. Only one credit is consumed. |
| Name | Required | Description |
|---|---|---|
| url | Yes | The normalised URL being scanned. |
| mode | Yes | Compliance framework in use: 'gdpr', 'ccpa', or 'gcm'. |
| note | Yes | Reminder to poll get_scan_status every 10–15 s. |
| region | Yes | Probe region: 'eu' or 'us'. |
| run_id | Yes | 8-character identifier for this scan run. Pass to get_scan_status / get_scan_report. |
| status | Yes | Always 'started'. |
| paired_run_id | No | Present only for paired scans. The run_id of the complementary (post-login) scan. |
| scan_group_id | No | Present only for paired pre/post-login scans. Links the two runs together. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds valuable context beyond the annotations: asynchronous execution (60-120s), immediate run_id return, paired scan behavior, and single credit consumption. These specifics complement annotations like readOnlyHint=false and openWorldHint=true without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise paragraphs: purpose, async workflow, and login pairing. Every sentence earns its place by providing operational detail (timing, next steps, credit cost) without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all critical operational aspects: async initiation, timing, polling/report flow, paired scans, and credit consumption. An output schema exists, so return values need not be described. It is complete for an agent to invoke and follow up correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already fully documents all 7 parameters, including the login pairing and credit consumption. The description reiterates login pairing but adds no new parameter-level detail, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Start a cookie consent compliance scan on the given URL', clearly stating the action, resource, and target. It distinguishes this initiating tool from sibling retrieval tools like get_scan_status and get_scan_report by focusing on scan creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly lays out the workflow: returns run_id immediately, poll with get_scan_status, then call get_scan_report or get_failing_checks. It also explains the paired scan behavior for login credentials. However, it does not provide explicit when-not-to-use guidance or name alternatives for different scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
No comments yet. Be the first to start the discussion!
