Bannerproof

app.bannerproofPublished by bannerproof.appOfficial publisherv1.1.1Updated Oct 30, 2026

EU cookie-consent audit: trackers before consent, Reject all, Consent Mode v2, TCF; evidence + fixes

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Bannerproof audits a website's EU cookie consent, letting an assistant check pre-consent trackers, Reject-all behavior, Consent Mode v2 and TCF, with evidence…

What you can do
  • Run a free quick check and score on any public site, and explain what a finding means with its legal basis
  • Retrieve full findings, evidence packs (requests, cookies, consent signals) as CSV or JSON, and private report links
  • Scan monitored domains, compare scans over time, and review scan history
  • Audit one site or up to 10 at once and check audit status
  • Manage account domains and read account info or upgrade links
When to use it
Useful when you need to verify whether a site loads trackers before consent, offers a first-layer Reject-all, or sets Consent Mode v2 and TCF signals correctly, and want findings with evidence, fixes and legal references to hand to a developer or client.
Requirements
Remote Streamable HTTP endpoint with OAuth 2.0 sign-in; a free quick check works without an account, while full findings, scans, audits and evidence exports need a Bannerproof account or an API token sent as a bearer token. Audits consume credits.
Before you install
Full features require signing in to a Bannerproof account or supplying an API token; audits cost one credit each and upgrade links point to paid plans. Scans target public sites and results are automated technical checks, not legal advice. Report links are private but shareable.

Installation

In SourceWeft

  1. Open Bannerproof in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/app.bannerproof%2Fbannerproof/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "bannerproof": {
      "type": "http",
      "url": "https://api.bannerproof.app/mcp"
    }
  }
}

README

Bannerproof — cookie-consent audits for AI assistants and CI

Bannerproof checks a website the way a real first-time visitor from the EU sees it, and reports:

  • trackers, analytics/ad tags and tracking cookies that load before consent;
  • whether the cookie banner has “Reject all” on the first layer, and what still fires after Reject;
  • Google Consent Mode v2 state per signal (ad_storage, analytics_storage, ad_user_data, ad_personalization);
  • IAB TCF consent string before a choice and after Reject;
  • Global Privacy Control (informational in the EU);
  • cookies the site sets that its own cookie policy doesn’t mention;
  • third-party embeds that leak visitor data before consent (Google Fonts, YouTube, Maps, reCAPTCHA).

Every finding comes with the exact request as evidence, a concrete fix (13 languages) and the legal reference (ePrivacy Art. 5(3), GDPR, national law). Works with any consent platform — Cookiebot, Usercentrics, OneTrust, Complianz, CookieYes, Borlabs, iubenda or a custom banner.

This repository holds the public pieces: the MCP server listing, connection examples and a GitHub Action. The service itself runs at bannerproof.app.

1. MCP server (Claude, ChatGPT, Cursor, …)

Remote MCP server, Streamable HTTP, OAuth 2.0:

https://api.bannerproof.app/mcp

A free quick check works without an account (https://api.bannerproof.app/mcp/free). Full findings, monitoring, audits and evidence exports use a Bannerproof account — sign in with OAuth when your client asks, or use an API token from Settings.

ClientHow to connect
Claude (claude.ai / Desktop)Settings → Connectors → find Bannerproof in the directory, or add a custom connector with the URL above
Claude Codeclaude mcp add --transport http bannerproof https://api.bannerproof.app/mcp
Cursorsee examples/cursor-mcp.json
Clinesee llms-install.md
Other clientsadd an MCP server with the URL above (OAuth), or send Authorization: Bearer <API token>

Step-by-step guide: bannerproof.app/help/connect-claude-chatgpt

Tools

ToolWhat it doesAccount
quick_checkyes/no + score for any public sitefree
explain_findingwhat a finding means, why it matters, how to fix it, legal basisfree
get_capabilitieswhat the server checks and what each tool doesfree
get_findingsfull findings with evidence, fixes and legal referencesyes
scan_domainfresh scan of a monitored domainyes
compare_scanswhat changed since the previous scanyes
get_evidenceevidence pack (every request with phase and time, cookies, consent signals) as CSV/JSONyes
get_report_linkprivate report link to send to a client or developeryes
audit_domain / audit_domainsaudit any site, or up to 10 at once (1 audit credit each; failed scans are refunded)yes
get_audits_statusstatus of several audits at onceyes
list_domains, add_domain, scan_history, account_info, get_upgrade_linkaccount helpersyes

The server is listed in the official MCP Registry as app.bannerproof/bannerproof (server.json).

2. Deploy check (CI)

Fail a pipeline when a release breaks cookie consent. The domain must be monitored in your Bannerproof account; create an API token in Settings and store it as a secret.

GitHub Action

yaml
- uses: bannerproof/bannerproof@v1  with:    domain: example.com    api-token: ${{ secrets.BANNERPROOF_TOKEN }}    fail-on: new   # "new" = only issues this release added (default), "any" = any issue

Full workflow: examples/github-workflow.yml.

Any other CI

bash
curl -fsS -X POST https://api.bannerproof.app/api/ci/check \  -H "X-Api-Token: $BANNERPROOF_TOKEN" -H "Content-Type: application/json" \  -d '{"domain":"example.com","failOn":"new"}'
HTTP statusMeaning
200pass
422fail — the JSON body lists new_issues
202still scanning — poll the poll URL from the body
429the domain was scanned less than 5 minutes ago (Retry-After header)
502the site couldn't be scanned

Webhook

In Settings you can also add a webhook: after every scan of a monitored domain Bannerproof POSTs a scan.completed event (score, new and resolved issues) signed with HMAC-SHA256 — X-Bannerproof-Signature: sha256=<hex of HMAC(secret, "<X-Bannerproof-Timestamp>.<body>")>.

Bannerproof is an automated technical check of what a site sends at scan time — not legal advice.

Support: [email protected]

Source: README.md at commit a8041fb

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

3
  1. v1.1.1LatestOct 30, 2026
  2. v1.1.0Oct 29, 2026
  3. v1.0.0Oct 26, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts