Applies to: Anyone connecting an AI coding assistant to Cookie Compliance

Procedure, not a feature announcement. The first list is what the live server offers with no account; the second needs a connected account.

If you build or maintain a site with an AI assistant that supports MCP (Model Context Protocol) — Claude Code, Cursor, and others — you can point it at Cookie Compliance instead of asking it to write a cookie banner by hand.

Try it with no account

Point the client at https://mcp.cookie-compliance.co/mcp.

Claude Code:

claude mcp add --transport http cookie-compliance https://mcp.cookie-compliance.co/mcp

Cursor: add a remote server in .cursor/mcp.json (project) or ~/.cursor/mcp.json (all projects). The url field is enough to start — no account header:

{
  "mcpServers": {
    "cookie-compliance": {
      "url": "https://mcp.cookie-compliance.co/mcp"
    }
  }
}

Cursor Settings → Tools & MCP can add the same URL. If the client supports MCP sign-in, it will prompt to connect in the browser. For a manual token later, put only the hu_ value in headers.Authorization as Bearer hu_… — never the whole login URL. See Cursor’s MCP docs for the config shape.

With no signup, no key and no card, the assistant can:

  • Install the real banner if you already have an AppID in the Cookie Compliance dashboard. It returns the snippet and the placement rule: first script in <head>, ahead of analytics, pixels and tag managers. On WordPress, install the plugin rather than pasting. Do not put the snippet inside a Google Tag Manager container.
  • Preview the look with no AppID. A preview records and enforces no consent, expires after 24 hours, and must be replaced with the real snippet before the site is “done”.
  • Derive a matching design from the site’s brand colour, page background, theme, corner style and text scale, then check every colour pair a visitor must read (body and headings on the banner, labels on the brand colour) against WCAG AA. It also validates values you already have. A preview honours that design; a live banner does not — the widget loads the published configuration and overwrites page-local design. Restyle a real banner in the dashboard (or with an authenticated connection), not by adding design to the install snippet.
  • Look up a setting — design, banner text, and the consent, blocking, region, consent-mode and GPC settings — with its default, accepted values, and whether changing it is a compliance decision.
  • Hand you the free signup URL when you have no account yet, with your site’s domain filled in on the add-domain screen after you register (when the assistant passes it). The Free plan needs no card. The assistant cannot create the account, complete the captcha, or verify your email.
  • Explain how to connect your account — browser sign-in first, the API-token route as a fallback.
  • Check the connection — whether it is signed in, and if not, why (no credential, expired, revoked or malformed).

On WordPress, install Cookie Compliance for WordPress rather than pasting a snippet.

Connect your account (optional)

To let the assistant work with a banner you already run, prove the connection belongs to your account. Two routes:

  • Browser sign-in (preferred). Add the server with no extra header. A client that supports MCP sign-in opens a Hu-manity page titled “Connect this application to your Hu-manity account?”. Before you click Connect, check two things: the Application named is the assistant you are using, and the Sends access to line is a place you recognise. Permissions are listed below those two fields. Then click Connect. Nothing to copy.
  • API token (fallback). If the client has no sign-in, create a token at https://app.hu-manity.co/#/api-tokens/new. The form asks for a name and an expiry — pick the latest date the screen allows. After you submit, the page shows a login URL. The Copy Link button copies that full URL to your clipboard. For MCP, use only the token= value from that URL (the part starting with hu_) in your header — not the whole login URL. Register it as a request header: Authorization: Bearer hu_… (or x-hu-api-token: hu_…). In Claude Code: claude mcp add --scope user --transport http cookie-compliance https://mcp.cookie-compliance.co/mcp --header "Authorization: Bearer hu_…". Keep --scope user: without it Claude Code saves the server for one project folder only, so any other folder connects with no header and stays signed out. After you add or change the header, start a new session; a running session does not pick it up. Never paste the value in a chat message, never as your password. It is shown once. A pasted token expires within 90 days and is never renewed: when it expires, create another.

The assistant cannot create this credential for you, and must never be given your dashboard password.
Once connected, the assistant can also:

  • List your apps and read the live design, settings and wording of one of them.
  • Register a site as a new app, ready to install. It reuses an app already registered for that domain rather than creating a duplicate. A new app starts on the default settings the dashboard applies, and on the New banner engine (v2) unless you ask for the Classic engine (v1).
  • Offer a GDPR starter for a new app. The assistant is told to ask you once and to change nothing unless you say yes. On Professional it turns on region detection, Google, Meta and Microsoft Consent Mode, and GPC; on Free, Google Consent Mode and GPC.
  • Change appearance and wording: it shows the exact before and after, then publishes.
  • Change compliance settings (blocking, consent levels, regions, consent mode, GPC, consent expiry, policy links): it shows the before and after with what each change means, and must get your agreement before it publishes.

Before you change configuration

Consent on Update (Professional; off by default) is what asks returning visitors to choose again after a configuration change. Only a change to a consent-mode Categories Mapping (Google, Meta or Microsoft) re-asks; changes to blocking, consent categories or regional rules do not. Reverting the change does not undo a re-ask that already happened. Design and wording changes do not re-ask. Stored consent logs are kept either way. Read any re-ask warning before you confirm a configuration change, whether you make it in the dashboard or ask an assistant to.

If the assistant reports it cannot apply a change because you have unpublished edits waiting in the dashboard on the same setting: click Publish Now if those edits are what you want, or edit the draft to the values you want and then publish. That refusal is intentional — it avoids publishing work you have not reviewed. There is no Discard button.

If it stops working

  • Account tools never appeared. The connection is not authenticated. Use browser sign-in, or check the token header is the hu_ value (not the whole login URL). If the hu_ token is cut short or mistyped, account calls now say the token is the wrong shape. If you pasted the whole login URL instead, it is not recognised at all and looks like “not signed in”. Ask the assistant to check the connection to see which.
  • It worked, then every account call returns an error. Tokens expire within 90 days and are not renewed. From 14 days before expiry, the assistant is asked to warn you each time it uses your account. Sign in again, or create a new token and re-register the hu_ value.
  • The banner shows but trackers still fire before a choice. The snippet is probably not first in <head>, or a cache/optimiser moved it, or it was loaded from Google Tag Manager. Move it above analytics, pixels and the tag-manager container. See Where to put the Cookie Compliance snippet.
  • Banner colours flashed, then reverted. A live banner loads the published configuration and overwrites design set only on the page. Change appearance in the dashboard (Design), then publish — not in the install snippet.

Still stuck? Contact support with your AppID and what the assistant reported.

Related Articles

Was this article helpful?
YesNo