Tools reference

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 15, 2026

Tools reference

Every tool registered by @cookiemunch/mcp (packages/mcp/src/tools.ts), grouped the way the server registers them. Each tool wraps one @cookiemunch/sdk call (or a short sequence of them) and returns its JSON result as the tool's text content; SDK errors are caught and returned as an isError result rather than crashing the MCP session. See Setup for how to connect a client.

Note: every tool acts on the org tied to the configured API key — no tool accepts an orgId. Admin tools (invite_member, set_member_role, remove_member, issue_api_key) require an unscoped key, exactly like the REST routes they call — see API keys, members, webhooks & usage.

Sites & config

Tool	What it does	Inputs
`whoami`	Return the identity tied to the API key: orgId, plan, key prefix.	—
`list_sites`	List all sites (cbids) in your organization.	—
`create_site`	Create a new site. The cbid is auto-generated if omitted.	`domain` (string), `cbid?` (string)
`delete_site`	Delete a site and its configuration from your org.	`cbid`
`get_site_config`	Get the banner/consent configuration for a site.	`cbid`
`update_site_config`	Upsert (merge) the banner/consent configuration for a site.	`cbid`, `config` (partial SiteConfig patch)
`verify_site`	Verify domain control via dns / meta / file challenge. Required to unlock consent export and signed receipts.	`cbid`, `method` (`dns` \| `meta` \| `file`)
`match_site_brand`	Extract theme colors/typography from a site's homepage to suggest a matching banner theme.	`cbid`
`get_install_snippet`	Get the exact `<script>` tag to install Cookie Munch on a site.	`cbid`, `blockingMode?` (`auto`\|`manual`\|`checklist`), `culture?`

Consent & privacy

Tool	What it does	Inputs
`get_consent_stats`	Aggregated per-day consent statistics for a site.	`cbid`, `from?`, `to?` (epoch-ms)
`get_consent_log`	Recent anonymised consent records for a site.	`cbid`, `from?`, `to?`, `limit?` (default 200)
`export_consent`	Export a site's consent log as raw CSV text.	`cbid`, `from?`, `to?`
`get_receipt`	Fetch the signed consent receipt for one consent record, by stamp.	`cbid`, `stamp`
`erase_subject_data`	Irreversibly crypto-erase a data subject's consent records by receipt stamp (GDPR/CCPA deletion).	`cbid`, `stamp`
`export_subject_data`	Export a data subject's consent records (GDPR access/portability).	`cbid`, `stamp`
`save_preference`	Save/update an end-user's consent preferences (purpose → boolean map).	`subjectId`, `purposes` (record of boolean)
`list_preferences`	List configurable consent preferences/purposes for your org.	—

DSAR

Tool	What it does	Inputs
`list_dsar`	List all Data Subject Access Requests for your organization.	—
`create_dsar`	Open a new DSAR.	`type` (`access`\|`deletion`\|`rectification`\|`portability`\|`opt-out`), `subjectEmail`, `regulation` (`gdpr`\|`ccpa`), `note?`
`advance_dsar`	Advance a DSAR to a new status.	`id`, `toStatus` (`received`\|`verifying`\|`in_progress`\|`completed`\|`rejected`)

Governance (vendors & RoPA)

Tool	What it does	Inputs
`list_vendors`	List vendors (processors) with their computed risk scores.	—
`create_vendor`	Register a vendor and compute its risk score.	`name`, `category`, `dataShared[]`, `dpaSigned`, `subprocessors`, `certifications[]`, `region`
`list_ropa`	List Records of Processing Activities for your organization.	—
`create_ropa`	Create a RoPA entry.	`name`, `purpose`, `legalBasis`, `dataCategories[]`, `recipients[]`, `retentionDays`, `crossBorderTransfer`

Cookies & scanning

Tool	What it does	Inputs
`get_site_cookies`	List the cookies discovered on a site, with their consent categories.	`cbid`
`scan_site`	Trigger a cookie scan for a site. Returns the scan job state.	`cbid`
`get_scan_status`	Get the status/result of a site's most recent cookie scan.	`cbid`
`get_ab_results`	Get A/B banner experiment results (per variant) for a site.	`cbid`

v2 banner flow editing

Tool	What it does	Inputs
`get_flow`	Get the v2 banner flow config for a site (views, categories, lint issues).	`cbid`
`edit_flow`	Apply a batch of structured edit ops (`addView`, `removeView`, `addElement`, `setButtonTransition`, `addCustomCategory`) to a site's flow. Validated and lint-clean before PUT; rejects empty op lists.	`cbid`, `operations[]` (each with an `op` field)
`set_flow`	Wholesale-replace a site's v2 flow with a complete config (e.g. from a template). Validates before PUT.	`cbid`, `config` (full v2 FlowConfig)

Structured v1 config (non-flow domains)

Each of these fetches the current config, patches only its own slice, and PUTs — safe to call without clobbering unrelated settings.

Tool	What it does	Inputs
`set_blocking`	Configure script-blocking mode.	`cbid`, `mode` (`auto`\|`manual`), `ignoreSelectors?[]`
`set_geo_rules`	Set geo-targeting rules (banner mode per country/region).	`cbid`, `geoRules[]` (`{ match: { countries?, regions? }, mode }`), `defaultMode?`
`set_languages`	Configure i18n: default culture, auto-detect, per-locale copy overrides.	`cbid`, `defaultCulture?`, `autoDetect?`, `translations?` (per-locale record)
`set_consent_mode`	Configure Google Consent Mode signals.	`cbid`, `enabled`, `mode` (`basic`\|`advanced`), `waitForUpdate?` (ms)
`set_ab_experiment`	Configure the A/B banner experiment.	`cbid`, `enabled`, `splitB` (0–100), `variantB?` (partial banner override)
`set_consent_policy`	Configure consent persistence (re-prompt policy).	`cbid`, `expiryDays?`, `version?`
`set_banner_basics`	Configure v1 banner appearance: type, layout, theme, copy.	`cbid`, `type?`, `layout?`, `theme?`, `content?`

Org, members & keys

Tool	What it does	Inputs
`list_members`	List the members of your organization.	—
`invite_member`	Invite a person to your org by email. `owner` is not assignable via API key.	`email`, `role` (`admin`\|`member`\|`viewer`)
`set_member_role`	Change a member's role. The owner's role cannot be changed.	`userId`, `role`
`remove_member`	Remove a member. The owner cannot be removed.	`userId`
`list_api_keys`	List API keys for your org (secrets are never returned).	—
`issue_api_key`	Issue a new API key. The secret is returned once.	—
`get_usage`	Get the current usage/quota summary for your organization.	—

Webhooks

Tool	What it does	Inputs
`list_webhooks`	List webhook subscriptions for your organization.	—
`create_webhook`	Create a webhook subscription. The response includes the signing secret (shown once).	`url`, `events[]`, `cbid?`
`delete_webhook`	Delete a webhook subscription by id.	`id`

Brand kits

Tool	What it does	Inputs
`list_brand_kits`	List reusable brand kits (colors/logo/typography) for your org.	—
`create_brand_kit`	Create a reusable brand kit.	`name`, `theme`, `content?`, `logoUrl?`, `customCss?`
`delete_brand_kit`	Delete a brand kit by id (must belong to your org).	`id`

Banner library

Tool	What it does	Inputs
`list_banners`	List reusable banner designs in your org.	—
`create_banner`	Create a reusable banner design.	`name`, `json` (a v2 BannerConfig)
`get_banner`	Get a banner design by id.	`id`
`update_banner`	Update a banner design's name and/or config.	`id`, `name?`, `json?`
`delete_banner`	Delete a banner design (fails if still assigned to sites).	`id`
`assign_banner`	Set which sites (cbids) use a banner design.	`id`, `cbids[]`
`publish_banner`	Publish a design live to all its assigned sites.	`id`

Example session

Once the server is connected, an agent can chain tools naturally:

User: Create a site for shop.example.com, install it, and open a GDPR
      access request for jane@example.com.

Agent calls: create_site({ domain: "shop.example.com" })
          -> get_install_snippet({ cbid: "site_9f01ab" })
          -> create_dsar({ type: "access", subjectEmail: "jane@example.com", regulation: "gdpr" })

Every call above is a thin wrapper over the identically-named SDK method — if a tool's behavior is ambiguous, its underlying client.* call and REST route are the source of truth.

Was this page helpful?