CookieRisk Quickscan

Scan a public homepage for cookies and tracking observed before consent interaction.

Ver en cookierisk.eu

Servidor MCP alojado

npx add-mcp 'https://cookierisk.eu/mcp'

Se instala en Claude Code, Codex, Cursor y más

Documentación

Connect

In an MCP-compatible assistant, add a remote server using Streamable HTTP, with no authentication:

https://cookierisk.eu/mcp

For clients configured with an MCP JSON file:

{
  "mcpServers": {
    "cookierisk": {
      "url": "https://cookierisk.eu/mcp"
    }
  }
}

Custom MCP availability depends on your assistant and its plan. This configuration does not mean CookieRisk is listed in its directory.

Listed on Tulimoa

Ask for a quickscan

Use CookieRisk to check https://example.com/ for cookies and tracking observed before interaction.

The assistant calls start_quickscan, waits for the indicated interval, then calls get_quickscan_result. If a scan is reused, the start response shows when its evidence was recorded, if available, and when the domain can request a new scan. Other capacity limits still apply.

Pilot limits

  • One homepage only, without URL queries, fragments, credentials or custom ports.
  • One new scan per registrable domain per 24 hours.
  • At most 10 scan attempts per day and 100 per calendar month across the entire pilot.
  • At most 5 start requests per hour and 20 per day per trusted network source; shared assistant infrastructure can share this allowance.
  • At most 1 MCP scan at a time and 5 waiting jobs. Browser capture is limited to 90 seconds; processing and saving results can take longer. There are no automatic retries.

Capacity may pause sooner for cost control. A rate-limit or capacity response tells the assistant when to try again; it must not repeatedly restart the scan.

What the result means

When supported by the stored evidence, the result shows the banner provider, controls visible on the first layer, and the CookieRisk score with its limitations. It distinguishes CMP signals from the provider of a visible banner, and confirmed tracking before consent from requests classified in tracking categories.

For requests in tracking categories, the report shows tag or service classifications and browser-recorded initiator hosts when available. It shows Google Consent Mode settings detected on the page separately from supported consent signals decoded from network requests.

A quickscan is a point-in-time observation of one page. It does not test accepting, rejecting or withdrawing consent, scan a whole website, or determine legal compliance. Unknown, incomplete and failed observations remain explicit.

The result contains sanitized evidence and a report link. Anyone with that report link can view it. MCP reports are excluded from CookieRisk's public lists and sitemap and marked noindex; this is not access control. Detailed evidence is scheduled for deletion after 30 days; cleanup can be delayed by processing failures.

Do not submit private, authenticated or sensitive URLs. CookieRisk does not need your chat history, passwords or API keys.

Privacy policy · Support