Skip to main content
Glama
Sign In
@cookiemunch/mcp

@cookiemunch/mcp

Official
by Cookie-Munch
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

@cookiemunch/mcp

A Model Context Protocol server that exposes the Cookie Munch Developer API (the /v1 surface) as MCP tools, built on top of @cookiemunch/sdk. Point an MCP client (Claude Desktop, Claude Code, …) at it and an assistant can manage sites, read consent analytics, and drive privacy operations on your behalf.

How it authenticates

The server reads an API key from the environment and derives your organization from it server-side — you never pass an orgId.

Env var

Required

Default

COOKIEMUNCH_API_KEY

yes

—

COOKIEMUNCH_BASE_URL

no

https://api.cookiemunch.net

Generate a key from the dashboard (it looks like fck_…).

Related MCP server: Yardstick ATS MCP Server

Tools

Tool

Description

whoami

Identity tied to the API key (orgId, plan, key prefix).

list_sites

List all sites (cbids) in your org.

create_site

Create a site (cbid auto-generated if omitted).

get_site_config

Get a site's banner/consent config.

update_site_config

Upsert (merge) a site's config.

get_consent_stats

Aggregated per-day consent statistics.

get_consent_log

Recent anonymised consent records.

list_dsar

List Data Subject Access Requests.

create_dsar

Open a new DSAR.

advance_dsar

Move a DSAR to a new status.

list_vendors

Vendors with computed risk scores.

list_ropa

Records of Processing Activities.

get_rights_page, update_rights_page, patch_rights_page, preview_rights_page

Read, replace, change or dry-run the hosted rights page draft. Pass baseUpdatedAt so a newer save is a conflict, not overwritten.

publish_rights_page, get_published_rights_page, list_rights_page_versions, rollback_rights_page

Publish (live at once), read the live page and its history, roll back. A rollback replaces the draft; pass baseUpdatedAt to both.

list_rights_page_domains, add_rights_page_domain, verify_rights_page_domain, remove_rights_page_domain

Serve the rights page on your own hostname.

create_rights_link

A signed, single-use rights-page link for a signed-in person.

get_mail_provider, set_mail_provider, test_mail_provider, remove_mail_provider

Your own email provider for rights-request mail.

The full list, with every argument, is on cookiemunch.net/docs/mcp-tools.

Client configuration

Claude Desktop / Claude Code

Add to your MCP servers config (claude_desktop_config.json, or via claude mcp add):

{
  "mcpServers": {
    "cookiemunch": {
      "command": "npx",
      "args": ["-y", "@cookiemunch/mcp"],
      "env": {
        "COOKIEMUNCH_API_KEY": "fck_your_key_here"
      }
    }
  }
}

Or, from a local checkout after pnpm --filter @cookiemunch/mcp build:

{
  "mcpServers": {
    "cookiemunch": {
      "command": "node",
      "args": ["/absolute/path/to/packages/mcp/dist/bin.js"],
      "env": {
        "COOKIEMUNCH_API_KEY": "fck_your_key_here"
      }
    }
  }
}

Programmatic use

import { createCookieMunchMcp } from '@cookiemunch/mcp';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

const server = createCookieMunchMcp({ apiKey: process.env.COOKIEMUNCH_API_KEY!, baseUrl: 'https://api.cookiemunch.net' });
await server.connect(new StdioServerTransport());

Available Tools

58 tools
advance_dsarA

Advance a DSAR to a new status (received → verifying → in_progress → completed, or rejected).

Inputs: id (required), toStatus (required).

assign_bannerC

Set which sites (cbids) use a banner design.

Inputs: id (required), cbids (required).

create_bannerC

Create a reusable banner design.

Inputs: json (required), name (required).

create_brand_kitB

Create a reusable brand kit (colors, logo, typography) for your organization's consent banners.

Inputs: name (required), theme (required), content, logoUrl, +1 more.

create_dsarC

Open a new Data Subject Access Request.

Inputs: type (required), regulation (required), subjectEmail (required), note.

create_ropaC

Create a Record of Processing Activity (RoPA) entry.

Inputs: name (required), purpose (required), legalBasis (required), recipients (required), +3 more.

create_siteA

Create a new site. The cbid is auto-generated if you omit it.

Inputs: domain (required), cbid.

create_vendorB

Register a vendor (processor) and compute its risk score.

Inputs: name (required), region (required), category (required), dpaSigned (required), +3 more.

create_webhookA

Create a webhook subscription. The response includes the signing secret (shown once).

Inputs: url (required), events (required), cbid.

delete_bannerA

Delete a banner design (fails if assigned to sites).

Inputs: id (required).

delete_brand_kitA

Delete a brand kit by id. The kit must belong to your organization (cross-org deletes are rejected).

Inputs: id (required).

delete_siteB

Delete a site (cbid) and its configuration from your org.

Inputs: cbid (required).

delete_webhookA

Delete a webhook subscription by id.

Inputs: id (required).

edit_flowA

Apply a batch of structured edit operations to a site's v2 banner flow. All ops are validated server-side and the final config must be lint-clean before it is saved.

Inputs: cbid (required), operations (required).

erase_subject_dataA

IRREVERSIBLY crypto-erase a data subject's consent records by their consent-receipt stamp (GDPR/CCPA deletion). Destroys the encryption key; the tamper-evident chain stays intact.

Inputs: cbid (required), stamp (required).

export_consentB

Export a site’s consent log as raw CSV text.

Inputs: cbid (required), to, from.

export_subject_dataC

Export a data subject's consent records (GDPR access/portability).

Inputs: cbid (required), stamp (required).

get_ab_resultsB

Get A/B banner experiment results (per variant) for a site.

Inputs: cbid (required).

get_bannerB

Get a banner design by id.

Inputs: id (required).

get_consent_logB

Get recent anonymised consent records for a site.

Inputs: cbid (required), to, from, limit.

get_consent_statsB

Get aggregated per-day consent statistics for a site.

Inputs: cbid (required), to, from.

get_flowA

Get the v2 banner flow config for a site, including current views, categories, and any lint issues.

Inputs: cbid (required).

get_install_snippetA

Get the exact tag to install Cookie Munch on a site. Copy and paste this into the of every page on the site.

Inputs: cbid (required), culture, blockingMode.

get_receiptA

Fetch the signed consent receipt for a single consent record (by stamp).

Inputs: cbid (required), stamp (required).

get_scan_statusB

Get the status/result of a site’s most recent cookie scan.

Inputs: cbid (required).

get_site_configB

Get the banner/consent configuration for a site.

Inputs: cbid (required).

get_site_cookiesA

List the cookies discovered on a site, with their consent categories.

Inputs: cbid (required).

get_usageA

Get the current usage/quota summary for your organization.

Inputs: no named parameters.

invite_memberA

Invite a person to your organization by email. role must be admin, member, or viewer. The org is derived from the API key — you cannot invite into a different org.

Inputs: role (required), email (required).

issue_api_keyA

Issue a new API key for your organization. The secret is returned once — store it securely. Subsequent requests cannot retrieve the secret again.

Inputs: no named parameters.

list_api_keysA

List the API keys for your organization (secrets are not returned).

Inputs: no named parameters.

list_bannersA

List reusable banner designs in your org.

Inputs: no named parameters.

list_brand_kitsA

List reusable brand kits (colors/logo/typography) for your org.

Inputs: no named parameters.

list_dsarA

List all Data Subject Access Requests for your organization.

Inputs: no named parameters.

list_membersB

List the members of your organization.

Inputs: no named parameters.

list_preferencesA

List configurable consent preferences/purposes for your org.

Inputs: no named parameters.

list_ropaA

List Records of Processing Activities (RoPA) for your organization.

Inputs: no named parameters.

list_sitesA

List all sites (cbids) in your organization.

Inputs: no named parameters.

list_vendorsA

List vendors (processors) with their computed risk scores.

Inputs: no named parameters.

list_webhooksA

List webhook subscriptions for your organization.

Inputs: no named parameters.

match_site_brandA

Extract theme colors and typography from a site's homepage to suggest a matching brand theme for the consent banner.

Inputs: cbid (required).

publish_bannerC

Publish a design live to all its assigned sites.

Inputs: id (required).

remove_memberA

Remove a member from your organization. The org owner cannot be removed.

Inputs: userId (required).

save_preferenceB

Save or update the consent preferences for an end-user (by subjectId) within your organization. purposes is a map of purpose-name → boolean.

Inputs: purposes (required), subjectId (required).

scan_siteB

Trigger a cookie scan for a site. Returns the scan job state.

Inputs: cbid (required).

set_ab_experimentA

Configure the A/B banner experiment for a site (enabled, split percentage, variant B overrides). Fetches the current config, patches only experiment, and PUTs.

Inputs: cbid (required), splitB (required), enabled (required), variantB.

set_banner_basicsA

Configure v1 banner appearance for a site: type, layout, theme tokens, and copy. Fetches the current config, patches only banner.{type,layout,theme,content}, and PUTs.

Inputs: cbid (required), type, theme, layout, +1 more.

set_blockingA

Configure the script-blocking mode for a site. Fetches the current config, patches only the blocking domain, and PUTs.

Inputs: cbid (required), mode (required), ignoreSelectors.

set_consent_modeA

Configure Google Consent Mode for a site (enabled, basic/advanced, waitForUpdate). Fetches the current config, patches only consentMode, and PUTs.

Inputs: cbid (required), mode (required), enabled (required), waitForUpdate.

set_consent_policyA

Configure consent persistence policy for a site (expiry days, version bump). Fetches the current config, patches only consent, and PUTs.

Inputs: cbid (required), version, expiryDays.

set_flowA

Wholesale replace a site's v2 banner flow with a complete config (e.g. from a template). Validated server-side before it is saved.

Inputs: cbid (required), config (required).

set_geo_rulesA

Set geo-targeting rules for a site (which banner mode to show per country/region). Fetches the current config, patches only geoRules + defaultMode, and PUTs.

Inputs: cbid (required), geoRules (required), defaultMode.

set_languagesA

Configure language/i18n settings for a site: default culture, auto-detect, and per-locale banner copy. Fetches the current config, patches only i18n + banner.i18n, and PUTs.

Inputs: cbid (required), autoDetect, translations, defaultCulture.

set_member_roleA

Change the role of a member in your organization. The org owner's role cannot be changed.

Inputs: role (required), userId (required).

update_bannerC

Update a banner design (name and/or config).

Inputs: id (required), json, name.

update_site_configA

Upsert (merge) the banner/consent configuration for a site.

Inputs: cbid (required), config (required).

verify_siteA

Verify that your organization controls a domain by one of three challenge methods (dns / meta / file). Required to unlock consent export and signed receipts.

Inputs: cbid (required), method (required).

whoamiA

Return the identity tied to the API key: orgId, plan, and key prefix.

Inputs: no named parameters.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.6/5.0

    Scored across 58 tools

    Disambiguation5/5

    Each tool has a distinct purpose, covering different resources and actions. Tools like set_banner_basics, update_banner, and edit_flow target different aspects of banner configuration, avoiding confusion. CRUD operations for entities like sites, banners, webhooks, and DSARs are clearly separated.

    Naming Consistency4/5

    Tool names follow a consistent verb_noun pattern (e.g., create_banner, list_sites, delete_webhook). Minor inconsistency exists between 'set_' (for specific config patches) and 'update_' (for full object updates), but descriptions clarify usage. Overall pattern is predictable.

    Tool Count4/5

    58 tools is above the typical range but justified for a full consent management platform. Each tool addresses a specific operation (CRUD, configuration, data subject requests, analytics, etc.), and no redundant tools are present. The count reflects the API's comprehensiveness.

    Completeness5/5

    The tool set covers all major aspects of consent management: site management, banner design and deployment, configuration (Geo, language, consent mode, blocking), data subject rights (DSAR, erasure, export, preferences), scanning, webhooks, and organizational management. No obvious gaps are present.

    Maintenance

    ActivityActive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • Yardstick ATS MCP Server

      Yardstick ATS MCP Serverofficial

      yardstickinc
      A
      license
      Not graded
      quality
      C
      maintenance
      A hosted, OAuth-authenticated MCP endpoint exposing 176 tools that let AI assistants read and write jobs, candidates, applications, interviews, scorecards, prospects, talent pools, and imports within an organization's own applicant tracking data, scoped to the signed-in user's existing permissions.
      MIT

    • webflow-mcp-server

      FrankKose
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables AI agents to interact with the Data API, manage sites and content, and perform Designer-related operations through MCP tools. It supports both remote OAuth and local API-token configurations.
      512 npm
      MIT