AI Agent Integration

ConsentLayer provides an MCP (Model Context Protocol) server that lets AI coding agents set up cookie consent end-to-end — create sites, scan for trackers, configure consent, and generate install code — without touching the dashboard.

Setup

Claude Code

Run this in your terminal:

npx @consentlayer/mcp setup

This auto-configures Claude Code to connect to the ConsentLayer MCP server.

Alternatively, run manually:

claude mcp add consentlayer --transport http "https://api.consentlayer.com/mcp"

Cursor / Windsurf / Other MCP Clients

Add to your MCP configuration file:

{
  "mcpServers": {
    "consentlayer": {
      "url": "https://api.consentlayer.com/mcp"
    }
  }
}

Authentication

ConsentLayer uses browser-based OAuth — no API keys needed. On the first tool call, your browser opens for login (or signup). Tokens are cached locally for future sessions.

Usage

Once connected, tell your agent what you need:

"Set up cookie consent on my website example.com"

The agent will use the MCP tools to handle everything automatically.

Recommended Workflow

The get_started tool returns the full guided workflow, but here's the overview:

Step	Tool	What it does
1	`setup_site`	Provisions the site, scans for trackers, auto-configures categories, returns the install snippet with the real project key
2	—	Place the snippet in `<head>` of every page (no `defer`, no `async`) and deploy
3	`check_installation`	Verifies the tag on the live site and returns the compliance punch list

Fine-grained tools (create_site, scan_site, configure_from_scan, update_banner_config, update_site_behavior, add_geolocation_group_from_template) exist for step-by-step control — get_started documents them all.

Copy-paste prompt

Paste this into your agent, swapping in your domain:

Set up ConsentLayer cookie consent on <your-domain>. If the ConsentLayer MCP server isn't connected, add it first: https://api.consentlayer.com/mcp. Call setup_site with my domain, add the returned snippet to the <head> of every page without defer or async, deploy, then call check_installation and report the compliance score and remaining action items.

Builder platforms (Lovable, Bolt, Replit)

Builder agents like Lovable, Bolt, and Replit run their own sandboxed agent and can't connect to external MCP servers, so the MCP flow above won't work there. Instead, create the site in the dashboard: go to Sites → Set up through an AI agent → Lovable / Bolt / Replit. That gives you a ready-made prompt containing your site's real install snippet — paste that prompt into the builder's chat. Never hand a builder a snippet with a placeholder project key; it will produce a non-functional integration.

Example Prompts

Full setup:

"Add GDPR cookie consent to my site example.com. Scan it for trackers and give me the install code."

Customize banner:

"Change my consent banner to a floating style in the bottom-right corner with blue buttons."

Add a service:

"Add Google Analytics to my site's statistics category."

Check status:

"Show me what tracking services are configured on my site."

Available Tools

Site Management

list_sites — List all your sites
create_site — Create a site with name and domain
update_site — Rename a site
delete_site — Delete a site and all its data (requires the site's domain as confirmation; refused while consent records exist)

Scanner

scan_site — Scan a website for tracking scripts and cookies
list_scans — View scan history
get_scan — Get detailed scan results
configure_from_scan — Auto-import detected services

search_library — Browse known services (Google Analytics, Meta Pixel, Hotjar, etc.)
get_library_service — Get full details about a library service
import_service — Import a service into a site

Services

list_site_services — List all services with their cookies
add_custom_service — Add a custom tracking service
remove_service — Remove a service

get_banner_config — Get current banner configuration
update_banner_config — Update template, position, colors, text

Setup & verification

get_started — Get the recommended workflow and see existing sites
get_setup_snippet — Generate the install code for any framework
check_installation — Verify the deployed snippet on the live site and return the compliance summary

Important Notes

The <script> tag must be placed in <head> without defer or async — it needs to run synchronously to block tracking scripts before they execute.
The banner is served as a static JS file per site, regenerated on every config change. No server-side rendering per page view.
Default consent categories (essential, statistics, marketing) are created automatically and cannot be deleted.
Script blocking uses DOM mutation observers to intercept dynamically-created scripts.