Cookie Scan

Scan a website for cookies, tracking scripts and consent banners, and sort cookies into necessary, analytics and marketing.

Pay by wallet (x402) AI-generated cookie-scan

Example

Input

{
  "url": "https://google.com"
}

Answer

{
  "url": "https://google.com",
  "cookies": [
    {
      "name": "__Secure-STRP",
      "path": "/",
      "domain": ".google.com",
      "secure": true,
      "expires": "Fri, 13-Mar-2026 14:44:29 GMT",
      "category": "necessary",
      "httponly": false,
      "samesite": "strict",
      "known_service": null
    },
    {
      "name": "AEC",
      "path": "/",
      "domain": ".google.com",
      "secure": true,
      "expires": "Wed, 09-Sep-2026 14:39:29 GMT",
      "category": "functional",
      "httponly": true,
      "samesite": "lax",
      "known_service": null
    },
    {
      "name": "NID",
      "path": "/",
      "domain": ".google.com",
      "secure": true,
      "expires": "Sat, 12-Sep-2026 14:39:29 GMT",
      "category": "marketing",
      "httponly": true,
      "samesite": "none",
      "known_service": "Google Ads"
    },
    {
      "name": "__Secure-BUCKET",
      "path": "/",
      "domain": ".google.com",
      "secure": true,
      "expires": "Wed, 09-Sep-2026 14:39:29 GMT",
      "category": "necessary",
      "httponly": true,
      "samesite": null,
      "known_service": null
    }
  ],
  "total_cookies": 4,
  "potential_issues": [
    "No explicit cookie consent banner detected",
    "Tracking functionality present (google.log, google.logUrl functions) without visible consent mechanism in provided HTML",
    "Google's own tracking infrastructure (ei, lei, cshid parameters) active without consent disclosure",
    "Performance monitoring and telemetry collection enabled (window.performance, google.timers)",
    "Third-party domain (gstatic.com) loaded without disclosure in visible consent banner"
  ],
  "tracking_scripts": [],
  "first_party_count": 4,
  "third_party_count": 0,
  "consent_banner_text": null,
  "third_party_domains": [
    "gstatic.com"
  ],
  "consent_banner_detected": false
}

Inputs

Field	Type	Required	What it is
`url`	string	Yes	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`cookies`	array	Always (present in every successful answer)
`total_cookies`	number	Always (present in every successful answer)
`tracking_scripts`	array	Always (present in every successful answer)
`consent_banner_detected`	boolean	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "cookie-scan",
    "inputs": {
      "url": "https://google.com"
    },
    "max_price_cents": 15
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "cookie-scan",
    "inputs": {
      "url": "https://google.com"
    },
    "max_price_cents": 15
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "cookie-scan",
  inputs: {
    "url": "https://google.com"
  },
  max_price_cents: 15,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="cookie-scan",
    inputs={
        "url": "https://google.com",
    },
    max_price_cents=15,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/cookie-scan?url=https%3A%2F%2Fgoogle.com'

Limitations

Only cookies set on initial page load are captured
Scans cookies set on initial page load — cookies set after user interaction or on sub-pages may not be captured
What to do instead: Run separate scans on high-traffic sub-pages (e.g., /checkout, /login) and merge the cookie inventories

Bundled checks that include it

Website GDPR Audit €1.00