# ConsentStack MCP Server

Set up GDPR and CCPA cookie consent from your AI agent. Create a site, publish a banner, get the install snippet, run a compliance scan, and categorize the trackers it finds, all through the [Model Context Protocol](https://modelcontextprotocol.io).

If you built your site with Claude, Cursor, Lovable, or Replit, this is the shortest path to a working cookie banner: the same agent that built the site can install consent on it.

**Hosted server. Nothing to install, no API keys.**

| | |
| --- | --- |
| Server URL | `https://app.consentstack.io/api/mcp` |
| Transport | Streamable HTTP |
| Authentication | OAuth 2.1 (sign in with your ConsentStack account) |
| Registry name | `io.consentstack/cookie-consent` |
| Docs | https://www.consentstack.io/docs/developers/mcp |

> **About this repository.** ConsentStack's MCP server is hosted, so this repo holds the server manifest, connection instructions, and tool reference rather than the server's source. Issues and questions are welcome here.

## Connect

**Claude Code**

```bash
claude mcp add --transport http consentstack https://app.consentstack.io/api/mcp
```

**Claude desktop or claude.ai**

Settings > Connectors > Add custom connector, then paste the server URL.

**Cursor** (`.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "consentstack": {
      "url": "https://app.consentstack.io/api/mcp"
    }
  }
}
```

**Any other client** that supports remote MCP servers over streamable HTTP with OAuth: give it the URL and sign in when prompted.

On first connect your client opens a browser window to sign in with the same account you use for the [dashboard](https://app.consentstack.io). No account yet? [Sign up free](https://app.consentstack.io/signup); the Basic tier costs nothing.

## Tools

22 tools, grouped by job.

| Job | Tools |
| --- | --- |
| Sites and setup | `list_sites`, `get_site_overview`, `create_site`, `manage_domains`, `get_setup_guide` |
| Banner configuration | `get_config`, `update_appearance`, `update_content`, `update_compliance`, `update_settings`, `publish_config`, `discard_draft` |
| Trackers and blocking | `list_detected_trackers`, `set_tracker_category`, `clear_tracker_override`, `set_hostname_policy` |
| Compliance scanning | `start_scan`, `get_scan_result` |
| Analytics and logs | `get_consent_analytics`, `get_consent_logs` |
| Documentation | `search_docs`, `get_doc` |

`get_setup_guide` returns install snippets with your real site key filled in, so the agent can paste working tags straight into your codebase.

## A full run

1. **Create.** `create_site` adds a site on the free Basic tier. `manage_domains` registers where it runs.
2. **Install.** `get_setup_guide` returns the install tags with your real site key.
3. **Configure.** The agent stages appearance, text, and compliance settings as drafts. Drafts never touch your live site.
4. **Publish.** After you approve the changes in conversation, `publish_config` makes them live.
5. **Verify.** `start_scan` runs the [compliance scanner](https://www.consentstack.io/compliance-scanner) against the live site: a real browser visits, declines the banner, and reports any tracker that fired anyway. The agent categorizes what the scan finds and rescans until it comes back clean.

Scan findings come back with remediation hints naming the exact tool that fixes them, so an agent can close the loop on its own.

## Access and permissions

Every request runs under your account with your team role, the same as the dashboard. Read tools work for any team member. Config writes (`update_*`, `publish_config`, tracker overrides) require the admin or owner role. The server's own instructions direct agents to summarize pending changes and get your explicit go-ahead before publishing anything.

Authentication is OAuth 2.1 with standard protected-resource discovery, so clients negotiate sign-in automatically. Tokens are issued to your account, never to a shared key, and every database query enforces the same row-level security the dashboard uses. There are no long-lived API keys to leak or rotate.

## Cost

MCP access is included on every plan, including the free Basic tier, and `create_site` creates Basic sites. Features belonging to paid plans (consent analytics and logs, for example) stay plan-gated exactly as they are in the dashboard. The tools tell your agent which plan unlocks them rather than working around the limit.

## Links

- [MCP server documentation](https://www.consentstack.io/docs/developers/mcp)
- [SDK installation](https://www.consentstack.io/docs/developers/sdk-installation)
- [Compliance scanner](https://www.consentstack.io/compliance-scanner)
- [ConsentStack](https://www.consentstack.io)