ConsentLayer

Search the cookie library for known services like Google Analytics, Meta Pixel, Hotjar, Stripe. Returns services you can import into a site to declare their cookies.

search_library

Create a custom geolocation group. Paid plans only — free plans must use `add_geolocation_group_from_template`. The `overrides` map is sparse: only listed fields override site_behavior; missing fields inherit.

create_geolocation_group

Remove a single cookie row from a service. The service itself stays — use `remove_service` to delete the whole service and its cookies.

delete_service_cookie

Delete a geolocation group. Visitors in the matched geo will fall back to site_behavior defaults on next pageview. Reversible — can be re-added from template or re-created from scratch.

delete_geolocation_group

Permanently delete a site and its configuration — banner config, services, scans, and the banner JS on the CDN. Irreversible. Consent audit records (consent records and do-not-sell requests) are PRESERVED: deletion is refused with an error while any exist; they age out via the plan's retention purge. Requires explicit confirmation: you must pass the site's exact domain as the `confirmation` parameter. If the agent doesn't know the domain, call `list_sites` first. Never call this without prior user authorization.

delete_site

Scan a configured site for tracking scripts and cookies (Google Analytics, Facebook Pixel, Hotjar, etc.). Use this to refresh detection after the user adds new trackers. For initial install, setup_site already runs a scan.

scan_site

Mark an unrecognized script as ignored. It won't appear in the pending review queue, and future scans won't re-prompt for the same pattern.

dismiss_unrecognized_script

Toggle the hosted cookie policy page on or off. Enabling is gated to the Agency tier; disabling works on any plan. When enabled, the page is hosted at `https://api.consentlayer.com/policy/<projectKey>`, auto-updates when categories/services/cookies change, and the banner's 'Cookie Policy' link points at it automatically (unless a custom cookiePolicyUrl is set). Call `get_cookie_policy` afterward for the embed snippet if the user wants the policy on their own site.

set_cookie_policy_enabled

Enables/disables the CCPA Do Not Sell opt-out surface, sets the link label and the request-form body text, toggles owner email notifications for new requests, and sets the auto-delete retention window for processed requests. Regenerates the banner. Returns the link snippet payload so you can install the link in the same turn.

configure_do_not_sell

Export a site's full configuration as a JSON snapshot — banner design, site behavior, categories, services, cookies, translations, geolocation groups. Use with `import_site_config` to clone a setup across sites or organizations.

export_site_config

Get the compliance setup score for a site (0–100) with the breakdown of items earned vs. missing. Use after setup to verify the configuration is launch-ready and surface remaining action items to the user.

get_compliance_score

Get the cookie policy page status for a site. Returns `enabled`, the rendered `publishedHtml`, `publishedAt`, and the distribution URLs when enabled: `publicUrl` (hosted page), `fragmentUrl` (raw HTML to inline in an SSR/build step), and `embedSnippet` (a <div> + <script> to paste into any page for a live, self-updating embed). To put the policy on the user's own site, hand them `embedSnippet`; to link it from the banner, set `update_banner_config` cookiePolicyUrl (or just leave it — an enabled page is auto-linked).

get_cookie_policy

Get current usage vs. plan limits for the authenticated organization (monthly pageviews, monthly consent records, site count). Use to answer 'am I close to my plan limit'. Returns status 'ok' / 'warn' (80%) / 'exceeded' (100%).

get_organization_usage

Compare two scans and return added/removed services + cookies. If `fromScanId` is omitted, diffs against the scan immediately preceding `toScanId`. Useful for answering 'what changed since last scan'.

get_scan_diff

Get the auto-scan schedule for a site (enabled, frequency, target URLs, last run, next run). Free plans always show enabled=false.

get_scan_schedule

Get the behavioral configuration for a site — consent model (opt-in/opt-out), GPC, script/content blocking, button visibility, post-consent floating UI, integrations (Google Consent Mode, Clarity), cookie scope, enabled languages, display rules.

get_site_behavior

Returns the copy-paste HTML for the CCPA "Do Not Sell or Share My Personal Information" footer link, plus the hosted request-form URL on paid plans. Use this when asked to add the Do Not Sell / privacy choices link to a site's footer. If you don't have the siteId, call list_sites first. If the response says the feature is disabled, call configure_do_not_sell first. For an embeddable request form instead of a link, use get_do_not_sell_embed.

get_do_not_sell_link

Returns a div+script snippet that renders the CCPA opt-out request form inside any page of the customer's site (paid plans). Use when asked to embed the do-not-sell / privacy-choices form on a page. For a plain footer link use get_do_not_sell_link.

get_do_not_sell_embed

Generate a ready-to-use code snippet to install ConsentLayer on a website, with the real project key embedded. Supported frameworks: script (plain HTML), react (Vite + React), next (Next.js App Router), astro (Astro), remix (Remix). For first-time installs prefer setup_site, which provisions the site AND returns the snippet in one call.

get_setup_snippet

Apply a previously exported config snapshot to a site. Categories and services merge by slug; geolocation groups are fully replaced (clean-slate). Regenerates the banner JS after import. Doesn't touch the projectKey or domain.

import_site_config

Paginated list of consent records for a site. Use this to surface recent consent activity. Filters: date range (`from`/`to` ISO dates), `country` (ISO 3166-1 alpha-2), `decision` ('accepted' | 'rejected' | 'partial'), `bannerVersion`. Max 100 per page.

list_consent_records

Paginated inbox of CCPA Do Not Sell requests for a site (paid plans). Filters: status ('pending' | 'processed'). Includes pendingCount — the CCPA deadline is 15 business days per request. Mark handled requests with process_do_not_sell_request.

list_do_not_sell_requests

List the geolocation groups configured for a site. Visitors are matched against these by IP at runtime, and the first match's overrides are applied on top of site_behavior.

list_geolocation_groups

List the built-in geolocation group templates (gdpr, ccpa, lgpd). Templates are read-only — to use one, call `add_geolocation_group_from_template`, which forks it into an editable site-owned group.

list_geolocation_templates

List scripts detected by the scanner that couldn't be matched to the known service library. The admin (or this MCP) categorizes them via `approve_unrecognized_script` so future scans auto-classify them.

list_unrecognized_scripts

Transitions a Do Not Sell request from pending to processed and stamps processedAt. Call after the customer confirms the opt-out has been honored in their systems.

process_do_not_sell_request

Provision a ConsentLayer site for a domain — auto-creates default banner config and three cookie categories (essential, statistics, marketing). For most installs, call setup_site instead — it does this AND scans + configures + returns the install snippet in one call.

create_site

Get full details of a scan: detected services, unrecognized scripts, errors. Use this to understand what trackers were found before configuring categories.

get_scan

Get the current banner configuration for a site: template, position, colors, text. Use this before update_banner_config to see what's set.

get_banner_config

Force a re-render of the hosted cookie policy page. Normally auto-runs when the banner config changes; use this if the published HTML drifts from the configured services or after a manual data fix.

regenerate_cookie_policy

Delete a custom category. The three default categories (essential, statistics, marketing) cannot be deleted.

delete_category

Delete a service and its declared cookies from a site. Use when the user has stopped using a particular tracker.

remove_service

Change the display name of a site. Does not change the domain or project key.

update_site

Update a consent category's display name and/or description. Works on the three default categories (essential, statistics, marketing) too — defaults are editable, they just can't be deleted. Use this to align category copy with a customer's cookie-policy wording. The slug is a stable identifier services reference and is never changed by this tool; pass only the fields you want to change.

update_category

Set the priority order of geolocation groups for a site. When a visitor's location matches multiple groups, the first one in this list wins. Pass the full list of group IDs in the desired order.

reorder_geolocation_groups

Read everything ConsentLayer knows about a library service: every cookie it sets, durations, descriptions, default category. Use this before importing if the user wants to know what they're declaring.

get_library_service

Install ConsentLayer on a website end-to-end: provision a site for the domain, scan it for trackers, auto-configure consent categories, and return the install snippet with the real project key embedded. Use this whenever the user wants to add cookie consent / GDPR / CCPA compliance to a site — it does in one call what create_site → scan_site → configure_from_scan → get_setup_snippet does separately. Safe to re-run: for a domain that is already set up it returns that site's snippet instead of creating a duplicate site — but every run does start a new scan, so it is not a no-op.

setup_site

Show every ConsentLayer site in the user's account, with domain and project key, plus the active organization (id + name). Use this to find an existing site before doing further work, or when the user asks 'what sites do I have?'. If an expected site is missing, check the returned `organization` — the site may belong to a different org than this token.

list_sites

List the consent categories on a site. Default categories: essential, statistics, marketing — these are auto-created and cannot be deleted.

list_categories

List the scan history for a site, most recent first.

list_scans