Website Scanner
The scanner visits your pages and reports the third-party scripts and cookies they load — Google Analytics, ad pixels, session recorders, and anything else that talks to another domain. It's the input to your consent setup: instead of auditing your site by hand, you scan it, review what it found, and let ConsentLayer turn those findings into categories, blocking rules, and cookie policy entries.
Running a scan
Manually — from the dashboard, open Site → Scanner and click Scan.
Over MCP or the API, call scan_site (agents) or
POST /sites/{id}/scan. By
default the scanner loads your homepage; pass a specific url to scan any other
page.
On a schedule — paid plans (Solo and above) can enable a recurring rescan so new trackers are caught as your site changes. The cadence is weekly, and you can point it at up to 10 specific URLs instead of just the homepage. Free plans can always scan on demand, but scheduled rescans stay off.
Configure scheduling in the dashboard, or over MCP with get_scan_schedule /
update_scan_schedule. Enabling requires a paid plan.
The review queue
When a scan finds a script that isn't in ConsentLayer's known-service library,
it lands in the Review Queue (Scanner → Review) so nothing unknown loads
unclassified. Each row shows the script URL and its hostname, and starts as
pending. You have two actions:
- Approve — pick the category it belongs to (Essential, Statistics, or Marketing) and approve it. ConsentLayer appends a blocking rule for that script so it's held until the visitor consents to that category.
- Dismiss — mark it reviewed without adding a rule (for example, a first-party script that doesn't need gating).
You can filter the queue by status (pending / approved / dismissed) to
revisit past decisions.
Over MCP the same flow is list_unrecognized_scripts,
approve_unrecognized_script, and dismiss_unrecognized_script.
Recognized services
Scripts the scanner does recognize are matched to library services with the correct default category already assigned — no manual triage needed. Import them in one step:
- Dashboard: review the detected services and confirm.
- MCP:
configure_from_scan { siteId, scanId }. - API:
POST /sites/{id}/scans/{scanId}/configure.
Each imported service is assigned to Essential, Statistics, or Marketing. That assignment drives two things automatically: the banner blocks the service's scripts until its category is consented, and the service (and its cookies) appears in your cookie policy.
Two exceptions to the blocking half: services assigned to Essential are never blocked (they have to run on the first page view), and a service whose script URLs aren't in the blocking library is disclosed but not blocked. For those, add a custom blocking rule under Settings → Blocking in the dashboard.
A sample scan
Scanning a typical marketing site turns up a mix of recognized services and one unknown vendor:
| Detected | Matched service | Category | Outcome |
|---|---|---|---|
snap.licdn.com/li.lms-analytics/insight.min.js | LinkedIn Insight Tag | Marketing | Auto-imported |
static.hotjar.com/c/hotjar-*.js | Hotjar | Statistics | Auto-imported |
googletagmanager.com/gtag/js | Google Analytics 4 | Statistics | Auto-imported |
cdn.segment.com/analytics.js | Segment | Statistics | Auto-imported |
cdn.vital-pixel.io/track.js | — (unknown) | — | Sent to Review Queue |
The four recognized services import with their categories set; the unknown
vital-pixel.io script waits in the review queue until you approve it against a
category (which adds its blocking rule) or dismiss it.
Programmatic use
- REST: Scanner API reference — trigger a scan, poll for completion, then configure services.
- MCP:
scan_site→get_scan→configure_from_scan, plus the review-queue tools above. See the AI Agent guide.