Brave Search MCP Server: web results, images, videos, rich results, AI summaries, and more.
Nothing to run from here
CookiePal is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
tool-list score
17
tools declared
remote
at its publisher
—
calls last 7d
What it does
Manage your CookiePal cookie banner: domains, the banner tag and style, and cookie scan reports.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http cookiepal-mcp https://mcp.cookiepal.io/mcp
# 2 — ask your agent for something these tools do
# plan_check, submit_check, forget_install and 14 more
CookiePal costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
COAll 1 server
cookiepal1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http cookiepal-mcp https://mcp.cookiepal.io/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
17 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Starts a check of one web page for cookies set before consent. Returns a check ID and the plan the local check follows: the page is loaded in a browser on the user’s own computer, never by CookiePal, and the plan carries the banner matchers for pressing accept and reject there. Send the result to submit_check within 30 minutes. No account needed. The local run this needs is made only by the Cookie
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | The page to check, http or https. CookiePal never requests it. |
| installId | string | no | A random install ID, sent only when the user agreed to share it in the plugin. Omit it otherwise. |
| pluginVersion | string | no | — |
Stores the result of a local check started with plan_check and returns it with a summary by category. Send each cookie with its category from @cookiepal-oss/cookie-db (necessary, functional, analytics, performance, advertisement or other) and its attributes, never its value. Include consent when the check pressed accept and reject, so the result says what survived an explicit reject. When no ban
| Parameter | Type | Required | Notes |
|---|---|---|---|
| checkId | string | yes | The check ID plan_check returned. |
| resultVersion | number | yes | — |
| cookies | array | yes | — |
| thirdPartyHosts | array | yes | — |
| truncated | boolean | no | True when the skill dropped cookies or hosts to fit the limits. |
| consent | object | no | What changed after accept and after reject. Omit it when the plugin did not run the consent action; the check is then an arrival-only reading. |
Deletes the checks CookiePal stored under one install ID. Run it from the plugin before the ID is removed from the machine, because once the ID is gone there is nothing left to look the checks up by. It answers with how many were deleted and how many remain: only a run reporting no remainder has finished, and running it again deletes just what is left. An ID that stored nothing reports zero of bot
| Parameter | Type | Required | Notes |
|---|---|---|---|
| installId | string | yes | The install ID to erase. Every check stored under it is deleted. |
Reports the CookiePal account this client is signed in as: the user, the organisation, the domain tools act on by default, and each domain’s plan and whether its page-view limit has been reached. Use it to confirm a connection, or to find out which domain other tools will use when none is given.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | no | The domain to report on. Defaults to the organisation’s current one. |
Connects this client to a CookiePal account, opening sign-in (or sign-up, for someone without an account) in the browser if needed, then reports who is connected: the user, the organisation and the domain other tools act on by default. Pass the plugin’s install ID only with linkInstall: true if the user agreed to link it to this account, or linkInstall: false if they said no.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| installId | string | no | The plugin’s install ID, sent with linkInstall to carry out the user’s answer to linking it to this account. Leave it out when the user shared no install ID. |
| linkInstall | boolean | no | Required with installId: true only if the user agreed to link the install ID to this account (a separate question from sharing it), false if they said no, which also removes any link made before. |
Lists the domains in the connected CookiePal account that this user can see, with each domain’s plan, this month’s page views, whether its page-view limit has been reached, and whether its banner has been found installed. Plans are per domain.
No parameter schema on file.
Adds a website domain to the connected CookiePal account on the free plan, with the same checks as the CookiePal dashboard, and queues its banner build. Nothing is scanned on CookiePal’s side: the result says how to run the first scan on the user’s computer. An organisation can add at most 10 domains a day this way. Other tools keep using the default domain unless given the new one.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | The domain to add, such as example.com. A URL is accepted: its scheme, a leading www. and any path are dropped. A port is refused, as in the dashboard, so send example.com, not example.com:8080. |
Returns the CookiePal banner script tag to paste into a site, for one domain in the connected account. It is byte-for-byte the tag the CookiePal dashboard copies for that domain, including defer for a Shopify store. Paste it as given: the URL it loads is specific to the domain, and a tag built by hand or copied from another site will not verify. Use verify_installation afterwards to confirm it i
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain’s tag to return, such as example.com. Omit it for the account’s default domain, the one the dashboard opens on. |
Records a check of one domain’s live page, loaded on the user’s own computer, and sets that domain’s banner verification status to verified or failed. Load the page locally first and send what it found: CookiePal never requests the page. The server compares the banner script the page loads with the one this domain’s tag must load, so a tag from another site, or a hand-built one, ends as failed wit
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain was checked, such as example.com. Omit it for the account’s default domain. |
| evidence | object | yes | What the page load on the user’s computer found. Send it exactly as the local verify step returned it; never assemble or edit it. |
Starts a crawl of one of your CookiePal domains on the user’s own computer, using the open-source crawl engine. CookiePal crawls nothing: run upload_scan_report with the result when the crawl finishes, and until then get_scan_report reports it as running. Needs the domain’s banner to be verified and active first, unless this is the very first scan of a domain just added with add_domain. The local
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain to scan, such as example.com. Omit it for the account’s default domain. |
| maxPages | integer | no | How many pages to crawl, up to 50. |
Stores the result of a local crawl started with start_scan, as a report labelled a local scan. Send the cookies with their category from @cookiepal-oss/cookie-db. When robots.txt blocked the crawl, send blockedByRobots and no report is stored. Each scan ID can be uploaded once. The local run this needs is made only by the CookiePal plugin in Claude Code on the user’s own computer: the terminal, th
| Parameter | Type | Required | Notes |
|---|---|---|---|
| scanId | string | yes | — |
| pagesScanned | integer | no | — |
| cookies | array | no | — |
| thirdPartyHosts | array | no | — |
| truncated | boolean | no | — |
| blockedByRobots | boolean | no | — |
Returns the latest cookie report for one of your CookiePal domains, with each cookie’s category, and says whether it came from a local scan. When a start_scan crawl is still running, reports that instead of an old report. The result reports what was found. It does not assess whether a site, page or banner complies with any law, so it is never a verdict of compliant or non-compliant.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain to report on. Omit it for the account’s default domain. |
Sets the category for a list of cookies on one of your CookiePal domains, and reports the result for each one. Send the category from @cookiepal-oss/cookie-db (necessary, functional, analytics, performance, advertisement or other).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain these cookies belong to. Omit it for the account’s default domain. |
| cookies | array | yes | — |
Reads Google Consent Mode on one of your CookiePal domains, from a page load on the user’s own computer, names the problem if there is one, and records the result on the domain as a local reading. Run this again any time to re-check. The local run this needs is made only by the CookiePal plugin in Claude Code on the user’s own computer: the terminal, the desktop app or an IDE extension. claude.ai
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain was checked. Omit it for the account’s default domain. |
| url | string | yes | The page that was read on the user’s computer. |
| seenAt | string | yes | When the reading was taken, ISO 8601. |
| reading | object | yes | Exactly what the gcm check command returned; never hand-built. |
Sets which privacy regulation one of your CookiePal domains’ banner follows: gdpr, ccpa or both, where both applies GDPR everywhere and CCPA to US visitors at the edge. It changes nothing else about the banner, and then queues a rebuild so the change goes live; if the domain has reached its page-view limit the rebuild is skipped, and the result says so.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain to change. Omit it for the account’s default domain. |
| bannerMode | string | yes | — |
Changes how one of your CookiePal domains’ banner looks and reads: its colours, logo type and colour, positions, and the title, description and button texts per language. Give only what you want to change; everything else keeps its saved value. It does not upload a custom logo or change category texts; use the CookiePal dashboard for those. Colour, logo and position changes queue a rebuild (skippe
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain to customise. Omit it for the account’s default domain. |
| colors | object | no | Only the colours you give change; the rest keep their saved value. |
| logo | object | no | The banner’s logo, default or cookie. A custom logo is kept as it is unless you set a type. |
| positions | object | no | Only the positions you give change; the rest keep their saved value. |
| texts | array | no | Banner and preference-centre copy per language the banner already has, as plain text; paragraphs are separated by a blank line. |
Queues a rebuild of the cookie banner script for one of your CookiePal domains, so it picks up the settings saved for it. It changes no setting and works on one domain only. If the domain has reached its page-view limit nothing is rebuilt, and the result says so.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domainId | string | no | Which domain to rebuild. Omit it for the account’s default domain. |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install CookiePal or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.0.0 · scanned 5 Nov 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 0 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digest7d47ab1614db6cf3079d8bff46024f7f38de20cd039f901f4b42f3aa48080ba1
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| plan_check | state-write | state-write: declares readOnlyHint: false |
| submit_check | state-write | state-write: declares readOnlyHint: false |
| forget_install | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| whoami | no tags | |
| connect_account | state-write | state-write: declares readOnlyHint: false |
| list_domains | no tags | |
| add_domain | state-write | state-write: declares readOnlyHint: false |
| get_install_snippet | no tags | |
| verify_installation | state-write | state-write: declares readOnlyHint: false |
| start_scan | untrusted-inputstate-write | untrusted-input: keyword "crawl"; state-write: declares readOnlyHint: false |
| upload_scan_report | untrusted-inputstate-write | untrusted-input: keyword "crawl"; state-write: declares readOnlyHint: false |
| get_scan_report | untrusted-input | untrusted-input: keyword "crawl" |
| classify_cookies | state-write | state-write: declares readOnlyHint: false |
| check_gcm_status | state-write | state-write: declares readOnlyHint: false |
| set_banner_mode | state-write | state-write: declares readOnlyHint: false |
| customise_banner | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| regenerate_banner | state-write | state-write: declares readOnlyHint: false |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digest7d47ab1614db6cf3
Scanned2026-11-05
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.0.0.
1.0.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish CookiePal can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.