Bannerproof

app.bannerproof由 bannerproof.app 发布官方发布者v1.1.1更新于 Oct 30, 2026

EU cookie-consent audit: trackers before consent, Reject all, Consent Mode v2, TCF; evidence + fixes

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

Bannerproof 审计网站的欧盟 Cookie 同意情况，让助手检查同意前的跟踪器、拒绝全部按钮、Consent Mode v2 与 TCF，并给出证据和修复建议。

可以做什么
  • 对任意公开网站做免费快速检查并给出评分，解释发现项的含义与法律依据
  • 获取完整发现、证据包（请求、Cookie、同意信号，CSV 或 JSON）以及私密报告链接
  • 扫描已监控域名、对比前后两次扫描并查看扫描历史
  • 审计单个站点或一次最多 10 个站点，并查询审计状态
  • 管理账户域名，查看账户信息与升级链接
适用场景
当你需要核实网站是否在获得同意前加载跟踪器、首层是否提供“拒绝全部”、Consent Mode v2 与 TCF 信号是否正确，并希望把带证据、修复建议和法律依据的结果交给开发者或客户时使用。
运行要求
远程 Streamable HTTP 端点，使用 OAuth 2.0 登录；免费快速检查无需账户，完整发现、扫描、审计和证据导出需要 Bannerproof 账户，或以 Bearer 方式提供 API 令牌。审计会消耗额度。
安装前请注意
完整功能需要登录 Bannerproof 账户或提供 API 令牌；每次审计消耗一个额度，升级链接指向付费方案。扫描针对公开网站，结果是自动化技术检查，不构成法律意见。报告链接为私密但可转发。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Bannerproof，将其添加到工作区。
  2. 连接 所需的 凭据。它们会被私密存储，绝不会在公开页面上展示。
  3. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/app.bannerproof%2Fbannerproof/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。 客户端会在首次连接时完成 OAuth 登录。

{
  "mcpServers": {
    "bannerproof": {
      "type": "http",
      "url": "https://api.bannerproof.app/mcp"
    }
  }
}

README

Bannerproof — cookie-consent audits for AI assistants and CI

Bannerproof checks a website the way a real first-time visitor from the EU sees it, and reports:

  • trackers, analytics/ad tags and tracking cookies that load before consent;
  • whether the cookie banner has “Reject all” on the first layer, and what still fires after Reject;
  • Google Consent Mode v2 state per signal (ad_storage, analytics_storage, ad_user_data, ad_personalization);
  • IAB TCF consent string before a choice and after Reject;
  • Global Privacy Control (informational in the EU);
  • cookies the site sets that its own cookie policy doesn’t mention;
  • third-party embeds that leak visitor data before consent (Google Fonts, YouTube, Maps, reCAPTCHA).

Every finding comes with the exact request as evidence, a concrete fix (13 languages) and the legal reference (ePrivacy Art. 5(3), GDPR, national law). Works with any consent platform — Cookiebot, Usercentrics, OneTrust, Complianz, CookieYes, Borlabs, iubenda or a custom banner.

This repository holds the public pieces: the MCP server listing, connection examples and a GitHub Action. The service itself runs at bannerproof.app.

1. MCP server (Claude, ChatGPT, Cursor, …)

Remote MCP server, Streamable HTTP, OAuth 2.0:

https://api.bannerproof.app/mcp

A free quick check works without an account (https://api.bannerproof.app/mcp/free). Full findings, monitoring, audits and evidence exports use a Bannerproof account — sign in with OAuth when your client asks, or use an API token from Settings.

ClientHow to connect
Claude (claude.ai / Desktop)Settings → Connectors → find Bannerproof in the directory, or add a custom connector with the URL above
Claude Codeclaude mcp add --transport http bannerproof https://api.bannerproof.app/mcp
Cursorsee examples/cursor-mcp.json
Clinesee llms-install.md
Other clientsadd an MCP server with the URL above (OAuth), or send Authorization: Bearer <API token>

Step-by-step guide: bannerproof.app/help/connect-claude-chatgpt

Tools

ToolWhat it doesAccount
quick_checkyes/no + score for any public sitefree
explain_findingwhat a finding means, why it matters, how to fix it, legal basisfree
get_capabilitieswhat the server checks and what each tool doesfree
get_findingsfull findings with evidence, fixes and legal referencesyes
scan_domainfresh scan of a monitored domainyes
compare_scanswhat changed since the previous scanyes
get_evidenceevidence pack (every request with phase and time, cookies, consent signals) as CSV/JSONyes
get_report_linkprivate report link to send to a client or developeryes
audit_domain / audit_domainsaudit any site, or up to 10 at once (1 audit credit each; failed scans are refunded)yes
get_audits_statusstatus of several audits at onceyes
list_domains, add_domain, scan_history, account_info, get_upgrade_linkaccount helpersyes

The server is listed in the official MCP Registry as app.bannerproof/bannerproof (server.json).

2. Deploy check (CI)

Fail a pipeline when a release breaks cookie consent. The domain must be monitored in your Bannerproof account; create an API token in Settings and store it as a secret.

GitHub Action

yaml
- uses: bannerproof/bannerproof@v1  with:    domain: example.com    api-token: ${{ secrets.BANNERPROOF_TOKEN }}    fail-on: new   # "new" = only issues this release added (default), "any" = any issue

Full workflow: examples/github-workflow.yml.

Any other CI

bash
curl -fsS -X POST https://api.bannerproof.app/api/ci/check \  -H "X-Api-Token: $BANNERPROOF_TOKEN" -H "Content-Type: application/json" \  -d '{"domain":"example.com","failOn":"new"}'
HTTP statusMeaning
200pass
422fail — the JSON body lists new_issues
202still scanning — poll the poll URL from the body
429the domain was scanned less than 5 minutes ago (Retry-After header)
502the site couldn't be scanned

Webhook

In Settings you can also add a webhook: after every scan of a monitored domain Bannerproof POSTs a scan.completed event (score, new and resolved issues) signed with HMAC-SHA256 — X-Bannerproof-Signature: sha256=<hex of HMAC(secret, "<X-Bannerproof-Timestamp>.<body>")>.

Bannerproof is an automated technical check of what a site sends at scan time — not legal advice.

Support: [email protected]

来源：README.md，提交 a8041fb

工具

0
该服务器需要登录，因此 SourceWeft 无法在没有账号的情况下读取其工具，也未收录。已连接账号所能看到的内容可能因账号及其权限而异。

版本历史

3
  1. v1.1.1最新Oct 30, 2026
  2. v1.1.0Oct 29, 2026
  3. v1.0.0Oct 26, 2026

评分

已满足适用检查项的 85%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分