---
name: cookiecomply
description: >
  Three-state cookie consent audits with CookieComply — capture before / Accept / Reject
  in a browser tool, then validate_capture and analyze_cookies via CookieComply MCP or
  /api/v1. Use when auditing GDPR cookie consent, CMP banners, or connecting Cursor,
  Claude, ChatGPT, Codex, or other agents to CookieComply.
---

# CookieComply

CookieComply **analyzes** captures. It does **not** open websites. You drive the browser (the **sensor**); MCP/API is the **brain**. No server stealth crawl.

**Setup:** https://cookie-comply.com/integrations  
**Hosted MCP:** `https://mcp.cookie-comply.com/mcp` (Bearer `COOKIECOMPLY_API_KEY`)  
**Install:** `npx skills add samir-abis/cookiecomply-skills` · `npx add-mcp https://mcp.cookie-comply.com/mcp -n cookiecomply -t http -h 'Authorization: Bearer ${COOKIECOMPLY_API_KEY}'`  
**CMP recipes:** monorepo package `@cookiecomply/cmp-catalog` (markers, Accept/Reject clicks, blocked signatures) — see `references/cmp-patterns.md`.

## References (read on demand)

| When | Read |
|------|------|
| Banner click fails, unknown CMP, bot wall | `references/cmp-patterns.md` (use catalog recipes; if blocked → stop) |
| validate_capture codes / recovery | `references/validate-codes.md` |
| Export formats / evidence fields | `references/export.md` |

## Workflow

1. Fresh browser → open URL. If Cloudflare / challenge / WAF interstitial → **stop**, report `blocked` (or wait briefly only in a headed session). Do **not** stealth-bypass. See cmp-patterns.
2. On the real site: cookies **before** → Accept via **catalog recipes** → settle → cookies **after**.
3. Second fresh session → real Reject via catalog (settings path if buried) → cookies **declined** (omit if Reject failed).
4. MCP `validate_capture` (free). On **hard** fail → fix capture; do not analyze.
5. Confirm with user → `analyze_cookies` / `POST /api/v1/analyze` + `Idempotency-Key` (1 scan). Analyze auto-enriches categories/explanations and attaches deterministic **legalJustification** + **recipeFamily** snippets. No separate `research_cookies` step required.
6. **Find the privacy/cookie policy yourself** (footer links, `/privacy`, `/cookie-policy`, `/cookies`). Extract page text or the declared cookie table, then call `compare_policy` with `policy_url` + `policy_text` and/or `declared_cookies`. CookieComply does **not** fetch policy URLs. Prefer structured `declared_cookies` when you can parse a table; free text alone triggers optional Vertex extract then the same deterministic diff.
7. Summarize for legal using recipes + `policyConflicts`; optional `export_scan` / `ask_ai` / `research_cookies` (interactive re-run only).

**Humans (no MCP):** Chrome extension → “Capture policy page” after Accept (visible `innerText` + URL in handoff), or on the scan report paste/upload policy text. Same `/policy-compare` path — no server fetch.

## Exports

- Prefer MCP `export_scan` with **`format=json`** for agent intake — includes recipe/legal fields, `implementationGuide`, `policyConflicts`, inventory states, evidence, `honestyNote`, and consent KPIs.
- Banner `suggestedConsentText` is **secondary** to recipes and policy conflicts.
- Response includes **`exportUrl`** for the same download via `GET /api/v1/scans/{id}/export`.
- Humans: dashboard **Scans → {id}** for evidence timeline + interactive exports. Details: `references/export.md`.

## Payload

```json
{
  "url": "https://example.com",
  "cookies": {
    "before": [{ "name": "_ga", "domain": ".example.com", "value": "…", "path": "/", "secure": true, "httpOnly": false }],
    "after": [],
    "declined": [],
    "captureMeta": { "acceptedClicked": true, "rejectedClicked": true }
  }
}
```

Omit `declined` and set `rejectedClicked: false` when Reject was not completed. Alias `afterReject` → `declined`.

### compare_policy example

```json
{
  "policyUrl": "https://example.com/cookie-policy",
  "policyText": "…extracted markdown/text…",
  "declaredCookies": [
    { "name": "_ga", "claimedCategory": "Analytics", "purpose": "Audience measurement" }
  ]
}
```

At least `policyText` or `declaredCookies` is required. URL alone → `policy_text_required`.

## Hard rules

- Fresh context for **before** and again for **declined** (no leftover Accept state).
- Use `@cookiecomply/cmp-catalog` recipes for CMP clicks; do not invent one-off selectors when the catalog covers the vendor.
- Bot wall / challenge HTML → report **`blocked`**, stop capture, **no stealth** (no proxies, no CAPTCHA solvers).
- Never invent cookie lists or Essential categories.
- Never invent Legitimate Interest for ePrivacy storage/access — use scan `legalBasis`.
- Never put `COOKIECOMPLY_API_KEY` in chat — env / MCP config only.
- On soft `declined_looks_like_preconsent`, tell the human post-reject evidence is unreliable.
- On `no_scans` / `test_key_not_allowed`, stop; do not retry loops.
- Confirm before actions that consume scans when the client supports it.

## Human fallback

Chrome extension for the same three-state capture; then ask the agent about scans already in the workspace.