Consent Checker MCP

Use the Consent Checker MCP server from Cursor, Claude Code, or another MCP client with the same API key you already use for the Consent Checker API.

What You Can Do

• Start a privacy, pixel, or CIPA audit across multiple consent flows
• Poll the audit, fetch evidence packs, generate the suite report, and share it
• Start a single consent check, including a post-consent journey
• List your recent runs and audits
• Fetch run status, the markdown report, and the raw session JSON
• Fetch screenshot metadata and browser-usable screenshot URLs
• Fetch tracking evidence, pixels analysis, and the CIPA flavor of that analysis
• Fetch or start an action replay
• Start summary generation and fetch summary or analysis status

Authentication

Your MCP client should send:

Authorization: Bearer <api_key>

The MCP server forwards that same Bearer token to the authenticated Consent Checker API.

That means:

• the API key determines which account is making the request
• you only see runs that belong to your account
• reports, sessions, screenshots, and summaries are scoped the same way

Deployed MCP Endpoint

Use the deployed MCP endpoint:

https://mcp.papayacomply.ai/mcp/

Cursor Config

Put this in .cursor/mcp.json:

{
  "mcpServers": {
    "consent-checker": {
      "url": "https://mcp.papayacomply.ai/mcp/",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Claude Code Style Config

If your MCP client accepts a URL plus headers, use:

{
  "name": "consent-checker",
  "url": "https://mcp.papayacomply.ai/mcp/",
  "headers": {
    "Authorization": "Bearer YOUR_API_KEY"
  }
}

Audit workflow

Use this order for a privacy, pixel, or CIPA investigation:

1. start_audit with kind of privacy, pixels, or cipa
2. get_audit until every child run is completed
3. get_audit_evidence
4. start_audit_report, then get_audit_report
5. share_audit once the suite report is ready

privacy runs reject-all, accept-all, and GPC in the requested region. pixels is the canonical pixel-litigation suite. cipa is the CIPA flavor of that same suite. Pass pages or journey_prompt on pixels or cipa to add a post-reject browsing journey. custom takes your own workflows.

Suite reports include findings, severity, applicable laws, evidence refs, supporting session ids, and remediation. Evidence packs include a tracking digest, plain-text compliance framing, screenshot URLs, and a results URL.

Available Tools

• start_audit
• get_audit
• list_audits
• get_audit_evidence
• start_audit_report
• get_audit_report
• share_audit
• run_consent_check
• list_recent_runs
• get_run_status
• get_run_report
• get_run_session
• get_run_screenshots
• get_tracking_evidence
• get_run_analysis
• start_run_analysis
• get_pixels_analysis
• start_pixels_analysis
• get_cipa_analysis
• start_cipa_analysis
• get_action_replay
• get_action_replay_script
• start_action_replay
• delete_run

get_run_session returns the full raw session JSON and can be large. Analysis tools return plain text unless you set include_html to true. get_cipa_analysis is the CIPA flavor of the pixels generator; get_pixels_analysis is the canonical pixel-litigation summary.

Audit resources

consent://audits/{audit_id}/report
consent://audits/{audit_id}/evidence

Screenshot Tool

Use get_run_screenshots with a run session_id to retrieve screenshot metadata plus browser-usable image URLs.

Example shape:

[
  {
    "supabase_path": "user/<session_id>/cookie-banner.png",
    "url": "https://...",
    "name": "cookie-banner.png",
    "label": "Initial Privacy Interface",
    "type": "cookie_banner"
  }
]

This is useful when you want to:

• display captured screenshots inline
• inspect which screenshots were captured for a run
• render the returned url directly in HTML

Screenshot Resource

The MCP server also exposes a screenshots resource:

consent://runs/{session_id}/screenshots

That resource returns the same screenshot metadata and browser-usable image URLs as the tool.

Screenshot URLs

Screenshot responses include browser-usable image URLs.

That means a frontend or client can render them directly, for example:

<img src="https://..." alt="Consent checker screenshot">

The client does not need a Supabase API key as long as the returned URL is already public or pre-signed.

Good To Know

• MCP access uses the same API key as the authenticated API
• runs started through MCP still appear in the web app
• reports, screenshots, sessions, and summaries remain available in the GUI
• if your API key works against the API, it should work the same way through MCP