Connect AI

Wire your agent to CookieComply

One access token. Hosted MCP is the default. Your agent captures before / Accept / Reject on the live page; CookieComply turns that capture into a report.

Usually under ten minutes to the first tool call

Get a token I already have a token

Before you start

CookieComply account on Professional or higher (tokens live there)
A browser tool in the agent (Playwright, Browser Use, or similar)

Done when the account exists and the browser tool is enabled

Create an access token

Open Settings → Connect AI & automation. Try it is a 1-hour token for a first run. Always-on is for Cursor (or similar) that stays connected.

Try it

1-hour token with analyze on. Good first run; it expires soon.

Always-on

Presets: view reports only, or Agent · run analyses (uses scan balance).

Open Settings → Connect AI

Done when the token sits in env, never paste it into chat

Connect hosted MCP

Point the agent at CookieComply’s hosted MCP. Set COOKIECOMPLY_API_KEY in the shell or agent env first.

Your client

Run the install command, or paste the JSON into Cursor MCP settings.

https://mcp.cookie-comply.com/mcp

npx add-mcp https://mcp.cookie-comply.com/mcp \
  -n cookiecomply \
  -t http \
  -h 'Authorization: Bearer ${COOKIECOMPLY_API_KEY}'

Done when CookieComply tools appear in the agent

Install Skills (playbook)

Gives the agent the audit workflow: before → Accept → Reject → validate → analyze.

npx skills add samir-abis/cookiecomply-skills

Done when the CookieComply skill is available to the agent

Paste a starter prompt

Swap in your URL, then let the agent run the three-state capture.

Install/read the CookieComply skill (SKILL.md). When banner clicks fail, read references/cmp-patterns.md; for validate codes read references/validate-codes.md.

Use my CookieComply token from env (COOKIECOMPLY_API_KEY) — do not ask me to paste the secret in chat.

1) Fresh browser on the URL below. Wait out Cloudflare if shown. Capture before → Accept → after; fresh session → Reject → declined (omit declined if Reject fails).
2) validate_capture. On hard fail, fix capture — do not analyze. Surface soft declined_looks_like_preconsent.
3) analyze_cookies / POST /api/v1/analyze.
4) Summarize GDPR risks for legal.

URL: https://example.com

Done when validate_capture passes and you have a report

A clean first run looks like this

Validate first. Analyze only after the capture checks out.

Audit https://shop.example.com for GDPR cookie risk.

toolvalidate_capture

Capture valid · before / accept / reject present

toolanalyze_cookies

Report ready · 3 high-risk findings

Three-state capture looks good. Tracking still fires after Reject; opening the full report.

Rather click through in Chrome?

The Chrome add-on does the same before / Accept / Reject capture. After that, ask your agent about scans already in the account.

Chrome Web Store

Same API, different callers

Everything hits /api/v1 with a Bearer token. Pick the interface that matches how you call it.

Hosted MCP

Recommended

Agents in Cursor, Claude, and other MCP clients: tools over HTTP, nothing to install locally.

npx add-mcp https://mcp.cookie-comply.com/mcp \
  -n cookiecomply \
  -t http \
  -h 'Authorization: Bearer ${COOKIECOMPLY_API_KEY}'

OpenAPI Hosted MCP

Setup FAQ

Also useful

Skill (web) · Capture guide
OpenAPI · llms.txt
REST API with the same Bearer token: https://cookie-comply.com/api/v1

Professional pricing · AI overview

Still need a token?

Create one in Settings, or check plans if you still need Professional for tokens.