MCP tools reference

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 15, 2026

MCP tools reference

Every tool registered by @cookiemunch/mcp — registerTools in packages/mcp/src/tools.ts, plus registerConfigTools in packages/mcp/src/tools-config.ts for the structured config tools. Each tool wraps one @cookiemunch/sdk call (or a short read-patch-write sequence against sites.getConfig/putConfig) and returns its JSON result as the tool's text content. SDK errors are caught and returned as an isError result instead of crashing the session. See MCP setup for how to connect a client.

Every tool acts on the org tied to the configured API key — none accepts an orgId. Admin tools (invite_member, set_member_role, remove_member, issue_api_key) require an unscoped key, exactly like the REST routes they call.

Sites & install

Tool	Purpose	Args
`whoami`	Identity tied to the API key: orgId, plan, key prefix.	—
`list_sites`	List all sites (cbids) in your org.	—
`create_site`	Create a site. cbid is auto-generated if omitted.	`domain`, `cbid?`
`delete_site`	Delete a site and its config.	`cbid`
`get_site_config`	Get a site's full banner/consent config.	`cbid`
`update_site_config`	Upsert (merge) a site's config.	`cbid`, `config` (partial patch)
`verify_site`	Verify domain control (dns / meta / file challenge). Required to unlock export + receipts.	`cbid`, `method` (`dns`\|`meta`\|`file`)
`match_site_brand`	Extract theme colors/fonts from a site's homepage.	`cbid`
`get_install_snippet`	Get the exact `<script>` install tag.	`cbid`, `blockingMode?` (`auto`\|`manual`\|`checklist`), `culture?`

Consent & privacy

Tool	Purpose	Args
`get_consent_stats`	Aggregated per-day consent stats.	`cbid`, `from?`, `to?` (epoch-ms)
`get_consent_log`	Recent anonymised consent records.	`cbid`, `from?`, `to?`, `limit?` (default 200)
`export_consent`	Export a site's consent log as raw CSV.	`cbid`, `from?`, `to?`
`get_receipt`	Signed consent receipt for one record.	`cbid`, `stamp`
`erase_subject_data`	Irreversibly crypto-erase a subject's records by stamp.	`cbid`, `stamp`
`export_subject_data`	Export a subject's records (access/portability).	`cbid`, `stamp`
`save_preference`	Save/update an end-user's purpose → boolean map.	`subjectId`, `purposes`
`list_preferences`	List configurable consent purposes for your org.	—

DSAR

Tool	Purpose	Args
`list_dsar`	List all DSARs for your org.	—
`create_dsar`	Open a new DSAR.	`type` (`access`\|`deletion`\|`rectification`\|`portability`\|`opt-out`), `subjectEmail`, `regulation` (`gdpr`\|`ccpa`), `note?`
`advance_dsar`	Move a DSAR to a new status.	`id`, `toStatus` (`received`\|`verifying`\|`in_progress`\|`completed`\|`rejected`)

Governance: vendors & RoPA

Tool	Purpose	Args
`list_vendors`	Vendors with computed risk scores.	—
`create_vendor`	Register a vendor; risk score computed server-side.	`name`, `category`, `dataShared[]`, `dpaSigned`, `subprocessors`, `certifications[]`, `region`
`list_ropa`	List Records of Processing Activities.	—
`create_ropa`	Create a RoPA entry.	`name`, `purpose`, `legalBasis`, `dataCategories[]`, `recipients[]`, `retentionDays`, `crossBorderTransfer`

Cookies & scanning

Tool	Purpose	Args
`get_site_cookies`	Cookies discovered on a site, with categories.	`cbid`
`scan_site`	Trigger a cookie scan.	`cbid`
`get_scan_status`	Status/result of the most recent scan.	`cbid`
`get_ab_results`	A/B banner experiment results per variant.	`cbid`

v2 banner flow editing

Tool	Purpose	Args
`get_flow`	Get a site's v2 flow (views, categories) + lint issues.	`cbid`
`edit_flow`	Apply a batch of ops (`addView`, `removeView`, `addElement`, `setButtonTransition`, `addCustomCategory`). All ops validated server-side; nothing saves unless lint-clean.	`cbid`, `operations[]` (each with `op`)
`set_flow`	Wholesale-replace a site's flow with a full v2 config.	`cbid`, `config`

Structured v1 config (non-flow domains)

Each fetches the current config, patches only its own slice, and PUTs — safe to call repeatedly without clobbering unrelated settings.

Tool	Purpose	Args
`set_blocking`	Script-blocking mode.	`cbid`, `mode` (`auto`\|`manual`), `ignoreSelectors?[]`
`set_geo_rules`	Banner mode per country/region, first-match-wins.	`cbid`, `geoRules[]` (`{ match: { countries?, regions? }, mode }`), `defaultMode?`
`set_languages`	i18n: default culture, auto-detect, per-locale copy.	`cbid`, `defaultCulture?`, `autoDetect?`, `translations?`
`set_consent_mode`	Google Consent Mode signals.	`cbid`, `enabled`, `mode` (`basic`\|`advanced`), `waitForUpdate?` (ms, default 500)
`set_ab_experiment`	A/B banner experiment.	`cbid`, `enabled`, `splitB` (0–100), `variantB?`
`set_consent_policy`	Re-prompt policy.	`cbid`, `expiryDays?`, `version?` (bump to force re-prompt)
`set_banner_basics`	v1 banner type/layout/theme/copy.	`cbid`, `type?`, `layout?`, `theme?`, `content?`

Org, members & keys

Tool	Purpose	Args
`list_members`	List org members.	—
`invite_member`	Invite by email. `owner` isn't assignable via API key.	`email`, `role` (`admin`\|`member`\|`viewer`)
`set_member_role`	Change a member's role. Owner's role can't change.	`userId`, `role`
`remove_member`	Remove a member. Owner can't be removed.	`userId`
`list_api_keys`	List keys (secrets never returned).	—
`issue_api_key`	Issue a new key; secret returned once.	—
`get_usage`	Usage/quota summary (domains, seats, monthlyEvents).	—

Webhooks

Tool	Purpose	Args
`list_webhooks`	List webhook subscriptions.	—
`create_webhook`	Create a subscription; response includes the signing secret once.	`url`, `events[]`, `cbid?`
`delete_webhook`	Delete a subscription.	`id`

See Webhooks & events for the full event catalog.

Brand kits

Tool	Purpose	Args
`list_brand_kits`	List reusable brand kits.	—
`create_brand_kit`	Create a brand kit.	`name`, `theme`, `content?`, `logoUrl?`, `customCss?`
`delete_brand_kit`	Delete a brand kit (must belong to your org).	`id`

Banner library

Tool	Purpose	Args
`list_banners`	List reusable banner designs.	—
`create_banner`	Create a design.	`name`, `json` (v2 BannerConfig)
`get_banner`	Get a design by id.	`id`
`update_banner`	Update name and/or config.	`id`, `name?`, `json?`
`delete_banner`	Delete (fails if still assigned to sites).	`id`
`assign_banner`	Set which sites use a design.	`id`, `cbids[]`
`publish_banner`	Publish a design live to its assigned sites.	`id`

Example session

User: Create a site for shop.example.com, install it, and open a GDPR
      access request for [email protected].

Agent calls: create_site({ domain: "shop.example.com" })
          -> get_install_snippet({ cbid: "site_9f01ab" })
          -> create_dsar({ type: "access", subjectEmail: "[email protected]", regulation: "gdpr" })

Every tool above is a thin wrapper over the identically-named SDK method — if a tool's exact behavior is ambiguous, its underlying client.* call is the source of truth.

Was this page helpful?