---
name: cookiecomply
description: Cookie compliance with CookieComply — capture cookies in a browser, then analyze via CookieComply. Use when auditing cookie consent or connecting an AI agent (Cursor, Claude, ChatGPT, Codex, etc.) to CookieComply.
---

# CookieComply Skill

**Setup guide:** https://cookie-comply.com/integrations  
**Capture steps:** https://cookie-comply.com/skills/cookiecomply/agent-capture.md  
**Hosted MCP:** `https://mcp.cookie-comply.com/mcp` (Bearer token)  
**Install skill:** `npx skills add samir-abis/cookiecomply-skills`  
**Install MCP (hosted):** `npx add-mcp https://mcp.cookie-comply.com/mcp -n cookiecomply -t http -h 'Authorization: Bearer ${COOKIECOMPLY_API_KEY}'`  
**Install MCP (local):** `npx -y @cookiecomply/mcp`  

## How it works

| Step | Who |
|------|-----|
| Open the site, record cookies before Accept, click Accept, record cookies after | Your browser tool (Playwright MCP, Browser Use, etc.) |
| Analyze the capture, store the scan, export reports, answer questions | CookieComply (`COOKIECOMPLY_API_KEY`) |

CookieComply does not open websites itself. The Chrome add-on is an alternative way for humans to capture.

## Connect once (human)

1. Sign in at https://cookie-comply.com (Professional plan or higher).
2. Settings → **Connect AI & automation** → create an access token.
3. Store it as `COOKIECOMPLY_API_KEY` in the agent’s env / MCP config — never ask the user to paste the secret into chat.

Use a **full-access** token to run new analyses. Read-only tokens can only view existing scans.

## Run an audit

1. Follow **agent-capture.md** for before/after cookies.
2. `POST https://cookie-comply.com/api/v1/analyze` with that JSON, header `Idempotency-Key: <unique id>`, and the Bearer token.
3. Summarize findings for legal in plain language.
4. Optional: export `GET /api/v1/scans/{id}/export?format=md|pdf|csv` or ask follow-ups on the scan.

## Payload

```json
{
  "url": "https://example.com",
  "cookies": {
    "before": [
      {
        "name": "_ga",
        "domain": ".example.com",
        "value": "…",
        "path": "/",
        "secure": true,
        "httpOnly": false
      }
    ],
    "after": []
  }
}
```

## Rules

- Fresh browser every audit (no leftover consent cookies for “before”).
- If Accept cannot be clicked, stop and ask the human — never invent cookie lists.
- Do not invent “Essential” categories; prefer Functional when unsure.
- On errors like no scans left or plan not entitled, tell the user clearly; do not retry in a loop.
- Confirm with the user before actions that consume scans, when the client supports confirmation.