Bannerproof

app.bannerproof由 bannerproof.app 發布官方發布者v1.1.1更新於 Oct 30, 2026

EU cookie-consent audit: trackers before consent, Reject all, Consent Mode v2, TCF; evidence + fixes

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

Bannerproof 稽核網站的歐盟 Cookie 同意狀況，讓助理檢查同意前的追蹤器、拒絕全部按鈕、Consent Mode v2 與 TCF，並提供證據與修正建議。

可以做什麼
  • 對任何公開網站執行免費快速檢查並給出評分，說明發現項的意義與法律依據
  • 取得完整發現、證據包（請求、Cookie、同意訊號，CSV 或 JSON）以及私密報告連結
  • 掃描已監控網域、比較前後兩次掃描並檢視掃描紀錄
  • 稽核單一網站或一次最多 10 個網站，並查詢稽核狀態
  • 管理帳戶網域，查看帳戶資訊與升級連結
適用情境
當你需要確認網站是否在取得同意前載入追蹤器、第一層是否提供「拒絕全部」、Consent Mode v2 與 TCF 訊號是否正確，並想把附有證據、修正建議與法律依據的結果交給開發者或客戶時使用。
執行需求
遠端 Streamable HTTP 端點，使用 OAuth 2.0 登入；免費快速檢查不需帳戶，完整發現、掃描、稽核與證據匯出需要 Bannerproof 帳戶，或以 Bearer 方式提供 API 權杖。稽核會消耗額度。
安裝前請注意
完整功能需要登入 Bannerproof 帳戶或提供 API 權杖；每次稽核消耗一個額度，升級連結指向付費方案。掃描對象為公開網站，結果是自動化技術檢查，不構成法律意見。報告連結為私密但可轉傳。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Bannerproof，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/app.bannerproof%2Fbannerproof/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "bannerproof": {
      "type": "http",
      "url": "https://api.bannerproof.app/mcp"
    }
  }
}

README

Bannerproof — cookie-consent audits for AI assistants and CI

Bannerproof checks a website the way a real first-time visitor from the EU sees it, and reports:

  • trackers, analytics/ad tags and tracking cookies that load before consent;
  • whether the cookie banner has “Reject all” on the first layer, and what still fires after Reject;
  • Google Consent Mode v2 state per signal (ad_storage, analytics_storage, ad_user_data, ad_personalization);
  • IAB TCF consent string before a choice and after Reject;
  • Global Privacy Control (informational in the EU);
  • cookies the site sets that its own cookie policy doesn’t mention;
  • third-party embeds that leak visitor data before consent (Google Fonts, YouTube, Maps, reCAPTCHA).

Every finding comes with the exact request as evidence, a concrete fix (13 languages) and the legal reference (ePrivacy Art. 5(3), GDPR, national law). Works with any consent platform — Cookiebot, Usercentrics, OneTrust, Complianz, CookieYes, Borlabs, iubenda or a custom banner.

This repository holds the public pieces: the MCP server listing, connection examples and a GitHub Action. The service itself runs at bannerproof.app.

1. MCP server (Claude, ChatGPT, Cursor, …)

Remote MCP server, Streamable HTTP, OAuth 2.0:

https://api.bannerproof.app/mcp

A free quick check works without an account (https://api.bannerproof.app/mcp/free). Full findings, monitoring, audits and evidence exports use a Bannerproof account — sign in with OAuth when your client asks, or use an API token from Settings.

ClientHow to connect
Claude (claude.ai / Desktop)Settings → Connectors → find Bannerproof in the directory, or add a custom connector with the URL above
Claude Codeclaude mcp add --transport http bannerproof https://api.bannerproof.app/mcp
Cursorsee examples/cursor-mcp.json
Clinesee llms-install.md
Other clientsadd an MCP server with the URL above (OAuth), or send Authorization: Bearer <API token>

Step-by-step guide: bannerproof.app/help/connect-claude-chatgpt

Tools

ToolWhat it doesAccount
quick_checkyes/no + score for any public sitefree
explain_findingwhat a finding means, why it matters, how to fix it, legal basisfree
get_capabilitieswhat the server checks and what each tool doesfree
get_findingsfull findings with evidence, fixes and legal referencesyes
scan_domainfresh scan of a monitored domainyes
compare_scanswhat changed since the previous scanyes
get_evidenceevidence pack (every request with phase and time, cookies, consent signals) as CSV/JSONyes
get_report_linkprivate report link to send to a client or developeryes
audit_domain / audit_domainsaudit any site, or up to 10 at once (1 audit credit each; failed scans are refunded)yes
get_audits_statusstatus of several audits at onceyes
list_domains, add_domain, scan_history, account_info, get_upgrade_linkaccount helpersyes

The server is listed in the official MCP Registry as app.bannerproof/bannerproof (server.json).

2. Deploy check (CI)

Fail a pipeline when a release breaks cookie consent. The domain must be monitored in your Bannerproof account; create an API token in Settings and store it as a secret.

GitHub Action

yaml
- uses: bannerproof/bannerproof@v1  with:    domain: example.com    api-token: ${{ secrets.BANNERPROOF_TOKEN }}    fail-on: new   # "new" = only issues this release added (default), "any" = any issue

Full workflow: examples/github-workflow.yml.

Any other CI

bash
curl -fsS -X POST https://api.bannerproof.app/api/ci/check \  -H "X-Api-Token: $BANNERPROOF_TOKEN" -H "Content-Type: application/json" \  -d '{"domain":"example.com","failOn":"new"}'
HTTP statusMeaning
200pass
422fail — the JSON body lists new_issues
202still scanning — poll the poll URL from the body
429the domain was scanned less than 5 minutes ago (Retry-After header)
502the site couldn't be scanned

Webhook

In Settings you can also add a webhook: after every scan of a monitored domain Bannerproof POSTs a scan.completed event (score, new and resolved issues) signed with HMAC-SHA256 — X-Bannerproof-Signature: sha256=<hex of HMAC(secret, "<X-Bannerproof-Timestamp>.<body>")>.

Bannerproof is an automated technical check of what a site sends at scan time — not legal advice.

Support: [email protected]

來源：README.md，提交 a8041fb

工具

0
該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

3
  1. v1.1.1最新Oct 30, 2026
  2. v1.1.0Oct 29, 2026
  3. v1.0.0Oct 26, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分