CMPStackCMPStack
Documentation

CMPStack MCP server

How to connect Claude, Cursor, or VS Code to CMPStack: personal access tokens, ten MCP tools, example prompts, privacy limits, and the hosted /api/mcp endpoint.

Ten tools. Owner-only tokens. Available on every plan, including Free.

What it is

The CMPStack MCP server is a hosted Model Context Protocol endpoint. After you connect an assistant with a personal access token, you can ask it to check whether a banner is live, copy the install snippet, restyle colors or position, or run a cookie scan — without opening the dashboard for every small change.

It is a configuration assistant, not a legal advisor. Scan quotas, DNS verification, and plan limits still apply. Consent logs and visitor data are never returned over MCP.

What the assistant can see

  • Domain list, verification, and regulation preset
  • Embed snippet and live install check
  • Banner layout position and colors
  • Scan counts by category and last-scan time
  • Configuration-gap score (not legal advice)

What it cannot see

  • Consent logs, visitor IPs, or user agents
  • Cookie names, values, or inventory rows
  • Banner heading, button labels, or policy URLs
  • Billing, Paddle IDs, or plan invoices
  • Team member emails or invite tokens

Set up

Tokens live on the workspace owner account. Create one in Dashboard → MCP, then paste it into your client.

  1. 1

    Sign in as the workspace owner

    Team members cannot enable MCP. Open Dashboard → MCP while signed in as the account owner.

  2. 2

    Enable MCP access

    Turn on MCP access for the workspace. This is off by default. Turning it off later revokes every token immediately.

  3. 3

    Create a personal access token

    Name the token (for example Claude or Cursor) and copy the secret once. Tokens start with cmp_live_. We store a SHA-256 hash only and cannot show the secret again. You can keep up to 5 active tokens.

  4. 4

    Add the server in your assistant

    Point Claude Code, Cursor, or VS Code at /api/mcp with an Authorization: Bearer header. CMPStack is not yet listed in Claude's connector directory — paste the URL and token yourself.

Connect a client

Replace YOUR_TOKEN with the secret shown once in the dashboard. Endpoint: https://cmpstack-production.up.railway.app/api/mcp

Claude Code

terminal
claude mcp add --transport http cmpstack https://cmpstack-production.up.railway.app/api/mcp --header "Authorization: Bearer YOUR_TOKEN"

Cursor

Add this to .cursor/mcp.json (project) or Cursor Settings → MCP.

mcp.json
{
  "mcpServers": {
    "cmpstack": {
      "url": "https://cmpstack-production.up.railway.app/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

VS Code

Use a workspace mcp.json or the MCP: Add Server command.

mcp.json
{
  "servers": {
    "cmpstack": {
      "url": "https://cmpstack-production.up.railway.app/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Tools

Ten tools. Seven are read-only. The three write tools should be approved in your assistant before they run. Pass domain as a hostname such as example.com or the dashboard domain id from list_domains.

list_domains

ReadDomains and setup

List every website in the connected CMPStack account.

No parameters.

Try: List every website on my account.

get_website_details

ReadDomains and setup

Show verification, regulation preset, geo-targeting, and auto-block flags for a site. Does not return legal copy or visitor data.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.

Try: Show verification and regulation flags for example.com.

get_embed_code

ReadDomains and setup

Return the head-first consent.js snippet for a domain.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.

Try: Give me the head-first embed snippet for example.com.

list_banners

ReadBanner management

List the live banner and saved named designs for a domain (layout and colors only — no heading or policy text).

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.

Try: What banner layouts and colors are live on example.com?

get_banner_status

ReadBanner management

Check whether the banner is configured and whether consent.js appears to be installed on the live site.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.
check_live(boolean)
Fetch the live homepage to verify the embed. Defaults to true.

Try: Is consent.js installed on the live homepage of example.com?

update_banner_colours

WriteBanner management

Set the live banner primary and text colors (hex). Does not change legal copy.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.
primary_color(string)
Hex color for buttons, e.g. #0f172a.
text_color(string)
Hex color for banner text, e.g. #0f172a.

Try: Set example.com banner buttons to #0f172a and text to #ffffff.

update_banner_layout

WriteBanner management

Move the live banner (and optionally the cookie button) to a supported position.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.
position(string)
Banner position: bottom-left, bottom-center, bottom-right, top-left, top-center, top-right, or center.
fab_position(string)
Floating cookie-button position: bottom-left, bottom-center, bottom-right, top-left, top-center, or top-right.

Try: Move the example.com banner to bottom-right.

get_scan_results

ReadCompliance and scanning

Return cookie-scan metadata: pages scanned, counts by category, and last scan time. Does not return cookie names, values, or visitor records.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.

Try: How many cookies did the last scan find on example.com?

get_compliance_status

ReadCompliance and scanning

Show the regulation preset, geo-targeting, and configuration gaps for a site. This is a setup check, not legal advice.

domain(string)
Domain hostname (example.com) or dashboard domain id from list_domains.

Try: What setup gaps does example.com have?

Example prompts

Speak in plain language. The assistant picks the tool. Replace example.com with a hostname from your account.

  • “List every website on my CMPStack account.”
  • “Is the cookie banner installed on example.com?”
  • “Give me the consent.js embed snippet for example.com.”
  • “What regulation preset and auto-block flags are on example.com?”
  • “Change the banner on example.com to #0f172a buttons and white text.”
  • “Move the example.com banner to bottom-right and the cookie button to bottom-left.”
  • “Summarize the last cookie scan on example.com — counts only.”
  • “Run a cookie scan on example.com.”
  • “Any compliance setup gaps on example.com?”

Privacy

Configuration, not people

MCP can read domain setup, banner layout/colors, scan counts, and compliance flags. It cannot read consent logs, visitor IPs, cookie values, billing, team emails, or legal copy.

Hashed personal tokens

Tokens are shown once, stored as SHA-256 hashes, and can be revoked. Disabling MCP access immediately revokes every active token.

Owner-only

Only the CMPStack workspace owner can enable MCP and create tokens. Team members cannot connect assistants to the account.

Write tools stay confirmable

Color, layout, and scan tools change the live banner or consume scan quota. Keep your assistant's tool-approval prompts on and read write calls before allowing them.

Limits

Plans

MCP is included on every plan, including Free. Scan depth and monthly scan quota still follow your plan.

Tokens

Up to 5 active personal access tokens per workspace. Revoke unused tokens. Disabling MCP access revokes all of them.

Rate limit

60 JSON-RPC requests per minute per IP. Live install checks and scans can take longer; the HTTP route allows up to 60 seconds.

Write side effects

Color and layout updates go live immediately and revalidate the public banner cache. Triggering a scan uses the same manual-scan quota as the dashboard.

Endpoint

POST https://cmpstack-production.up.railway.app/api/mcp accepts JSON-RPC 2.0 (single object or a batch array). Authenticate with Authorization: Bearer cmp_live_…. GET returns a short discovery document. CORS is open so browser MCP clients can call it. Streamable HTTP is supported; SSE GET is not.

tools-call.json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_domains",
    "arguments": {}
  }
}

Troubleshooting

401 Unauthorized

The Bearer token is missing, malformed, revoked, or not a cmp_live_ secret. Create a new token in Dashboard → MCP and update the client header.

403 MCP access is disabled

The workspace owner turned MCP off. Enable it again under Dashboard → MCP. That does not restore old tokens — create a new one.

429 Too many requests

Wait a minute and retry. The public MCP endpoint allows 60 requests per minute per IP.

Domain not found

Ask the assistant to run list_domains first, then pass the hostname or domain id exactly as returned. MCP only sees websites owned by the token's workspace.

Scan did not run

Manual-scan quota may be exhausted, or the domain is unverified. Check Dashboard → Overview for remaining scans. Free uses an HTTP scan; Starter+ can run a deeper browser scan.

Claude cannot find CMPStack in the connector directory

CMPStack is not listed there yet. Use a personal access token and the hosted /api/mcp URL in Claude Code, Cursor, or VS Code. Directory listing is on the roadmap.

MCP FAQ

Answers about connecting CMPStack to Claude, Cursor, and VS Code.

CMPStack hosts a Model Context Protocol server so Claude, Cursor, or VS Code can manage cookie-consent configuration in plain language. It lists domains, returns embed code, checks whether the banner is live, restyles colors and layout, and can trigger a cookie scan.

Any MCP client that supports Streamable HTTP with a custom Authorization header. We publish snippets for Claude Code, Cursor, and VS Code. Claude's in-app connector directory is not supported yet.

Yes. Enable it under Dashboard → MCP on every plan. Cookie-scan depth and monthly scan quota still follow your plan limits.

No. Only the CMPStack workspace owner can enable MCP and create or revoke tokens.

No. MCP never returns consent logs, visitor IPs, cookie names or values, billing, team emails, or legal/banner copy. Scan tools return counts and timestamps only.

Revoke an individual token under Dashboard → MCP, or turn MCP access off to revoke every token at once. Clients keep working until the next request after revoke.

Yes. update_banner_colours and update_banner_layout update the live banner. trigger_cookie_scan starts a dashboard scan and uses quota. Keep tool-approval prompts on in your assistant.