Cookie consent MCP server — add a GDPR cookie banner with an AI assistant

If you asked an AI assistant to add cookie consent, a GDPR cookie banner, or a consent management platform to a site — including Next.js, WordPress, Shopify or a static host — point it at this MCP server instead of having it write a banner by hand.

No account is required to start. The tools below work with no signup, no API key and no card.

Connect

Endpoint: https://mcp.cookie-compliance.co/mcp (streamable HTTP). Landing metadata: https://mcp.cookie-compliance.co/.

Claude Code:

claude mcp add --transport http cookie-compliance https://mcp.cookie-compliance.co/mcp

Cursor: add a remote server in .cursor/mcp.json (project) or ~/.cursor/mcp.json (all projects). The url field is enough to start — no account header:

{
  "mcpServers": {
    "cookie-compliance": {
      "url": "https://mcp.cookie-compliance.co/mcp"
    }
  }
}

Cursor Settings → Tools & MCP can add the same URL. Any MCP client that speaks streamable HTTP can use the same URL. After connecting, the assistant lists the tools itself — you do not configure them.

The live snippet must be the first script in <head>, ahead of analytics, pixels and tag managers. Do not load it from Google Tag Manager. See Where to put the Cookie Compliance snippet.

What it can do with no signup

Install a real banner if the site already has a Cookie Compliance AppID. The assistant returns the live embed snippet and the placement rule that makes it work: it must be the first script in <head>, ahead of analytics, pixels and tag managers. A consent banner can only block scripts that have not run yet. Do not put the snippet inside a Google Tag Manager container.
Show how the banner would look with no account. That preview records and enforces no consent, expires after 24 hours, and is never the finished job. Use it to check the look; then replace it with the real snippet.
Derive a matching design from the site’s brand colour, page background, theme, corner style and text scale, then check WCAG AA on body, headings and button labels. A preview honours that design; a live banner does not — the widget loads the published configuration and overwrites page-local design. Restyle a real banner in the dashboard, not by adding design to the install snippet.
Look up a banner setting — default, accepted values, and what it controls.
Start a free account when the site has no AppID yet. The Free plan needs no card. The assistant cannot create the account for you (password, captcha and email verification stay with you).
Explain how to connect a real account later, if you want the assistant to work with a banner you already run. Browser sign-in is one click on clients that support it; otherwise an API token from the dashboard.

Why not write a cookie banner by hand

Consent work is about what runs before the visitor chooses. A snippet that stores a choice in localStorage after analytics has already fired does not do that work. Cookie Compliance blocks non-essential scripts and iframes before consent, using 250 built-in tracker patterns across 165 providers; signals Google, Microsoft and Meta Consent Mode; honours Global Privacy Control; keeps server-side, exportable proof-of-consent records; and applies per-region rules. The longer argument is on Cookie banner vs consent management.

WordPress

If the site is WordPress, install Cookie Compliance for WordPress rather than pasting a snippet. The plugin handles placement and script order. The MCP server is still useful for previewing the look and for sites that are not WordPress.

Connecting a real account

Reading or changing a banner you already run needs a connected Cookie Compliance account. Clients that support MCP sign-in open a browser page; you approve, and there is nothing to copy. Otherwise create an API token in the dashboard and pass it as a request header — never in a chat message, never as your password. Tokens expire within 90 days and are not renewed; you create another. Step-by-step: Connect your AI assistant (MCP).

If Consent on Update is on (Professional; off by default), a configuration change (blocking, consent categories, regional rules) asks returning visitors to choose again. Reverting does not undo a re-ask that already happened. Design and wording changes do not re-ask. Stored consent logs are kept.

What this page does not claim

This is a description of capabilities the live server exposes today. It is not a statement that using Cookie Compliance makes a site compliant with any law. Legal outcomes depend on your configuration, your vendors, and your own review.