GDPR Scanner API

io.github.Br0ski777Published by GitHub account Br0ski777v1.1.0Updated Oct 24, 2026

Scan website GDPR compliance: consent, privacy policy, trackers. Score 0-100. x402.

VerifiedSSEWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server that scans a website for GDPR compliance — cookie consent, privacy policy and third-party trackers — and returns a 0–100 score.

What you can do
Scan a website URL for GDPR compliance, including its privacy-policy and cookie-policy pages, and get a JSON report with a 0–100 compliance score, detected cookie consent, privacy policy link, third-party trackers and recommendations. The same scan is offered as a GET and a POST variant.
When to use it
Useful when launching a site in the EU, running a privacy or compliance audit, doing due diligence on an acquisition, or monitoring a site's privacy posture over time.
Requirements
A remote endpoint; no local runtime, account or API key. Each call is paid per use in USDC on the Base network through the x402 protocol, so an x402-capable client with a funded wallet is needed. Network access to the endpoint is required.
Before you install
Every scan costs money (listed at $0.03 per call) in USDC from your wallet, and an x402-capable client signs payments automatically, so spending can add up without a prompt. The scanned URL and its policy pages are sent to a third-party service, and payment is handled through external facilitators.

Installation

In SourceWeft

  1. Open GDPR Scanner API in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via SSE. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Br0ski777%2Fgdpr-scanner/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "gdpr-scanner-api": {
      "type": "sse",
      "url": "https://gdpr-scanner.api.klymax402.com/mcp"
    }
  }
}

README

GDPR Scanner API

[MCP Server] [x402] [License: MIT]

Scan any website for GDPR compliance -- cookie consent, privacy policy, trackers, DPO contact. Score 0-100. Pay-per-call via x402 (USDC on Base L2) -- no API key, no signup, no rate-limit wall.

Part of the klymax402 marketplace -- 100 x402 micropayment APIs for AI agents, one wallet, USDC on Base.

Quickstart -- MCP

Add to your MCP client config (Claude Desktop, Cursor, ElizaOS, etc.):

json
{  "mcpServers": {    "gdpr-scanner": {      "url": "https://gdpr-scanner.api.klymax402.com/mcp"    }  }}

Quickstart -- HTTP (x402)

bash
curl "https://gdpr-scanner.api.klymax402.com/api/scan?url=https://example.com"# -> 402 Payment Required, with an x402 payment challenge in the response body

Any x402-aware client (@x402/fetch, x402-agent-tools, ATXP) handles the 402 -> sign -> retry cycle automatically.

Tools

ToolMethodPathPriceDescription
compliance_scan_gdprGET/api/scan$0.03Scan a website for GDPR compliance — cookie consent, privacy policy, trackers
compliance_scan_gdprPOST/api/scan$0.03Scan a website for GDPR compliance — cookie consent, privacy policy, trackers (POST variant)

compliance_scan_gdpr

Use this when you need to check a website's GDPR compliance. Scans the URL plus /privacy-policy and /cookie-policy pages. Returns a compliance report in JSON.

Parameters

NameTypeRequiredDescription
urlstringyesWebsite URL to scan for GDPR compliance (e.g. https://example.com)

Example response:

json
{"url":"https://example.com","complianceScore":72,"cookieConsent":{"detected":true,"type":"banner"},"privacyPolicy":{"found":true,"url":"/privacy"},"thirdPartyTrackers":["Google Analytics","Facebook Pixel"],"recommendations":["Add DPO contact info","Add data retention policy"]}

When to use: launching a website in the EU, FOR compliance audits, due diligence on acquisitions, and regular privacy monitoring.

Not for: PII in text (use compliance_detect_pii), tech detection (use website_detect_tech_stack), HTTP security headers (use network_analyze_headers).

compliance_scan_gdpr

Use this when you need to check a website's GDPR compliance. Scans the URL plus /privacy-policy and /cookie-policy pages. Returns a compliance report in JSON. POST variant of compliance_scan_gdpr -- same params passed as JSON body instead of query string.

Parameters

NameTypeRequiredDescription
urlstringyesWebsite URL to scan for GDPR compliance (e.g. https://example.com)

Example response:

json
{"url":"https://example.com","complianceScore":72,"cookieConsent":{"detected":true,"type":"banner"},"privacyPolicy":{"found":true,"url":"/privacy"},"thirdPartyTrackers":["Google Analytics","Facebook Pixel"],"recommendations":["Add DPO contact info","Add data retention policy"]}

When to use: launching a website in the EU, FOR compliance audits, due diligence on acquisitions, and regular privacy monitoring.

Not for: PII in text (use compliance_detect_pii), tech detection (use website_detect_tech_stack), HTTP security headers (use network_analyze_headers).

Example agent prompts

  • "Check a website's GDPR compliance"
  • "Check a website's GDPR compliance"

Payment

  • Protocol: x402 -- HTTP-native pay-per-call, no signup, no API key
  • Network: Base L2 (eip155:8453)
  • Asset: USDC
  • Facilitator: Coinbase CDP (primary), PayAI (fallback)

Part of klymax402

100 x402 micropayment APIs for AI agents -- one wallet, USDC on Base, zero signup.

License

MIT

Source: README.md at commit 6cfbd1b

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts