Installation

Claude Code: You need Claude Code, the AI coding tool from Anthropic, installed and signed in.

Node.js and a browser: Checks load pages in a browser on your own machine, so you also need Node.js 24 or later and Google Chrome, Microsoft Edge, Brave or Chromium. If your browser is installed somewhere unusual, set the COOKIEPAL_BROWSER environment variable to its executable.

Account: You do not need a CookiePal account to check a page. You only need one to scan, install and verify the banner on a site you run, and you can create one from Claude Code in the third step.

Install in Claude Code: Open Claude Code and run these three commands, one at a time.

1/plugin marketplace add cookiepal/cookiepal-plugin
2/plugin install cookiepal@cookiepal
3/reload-plugins

Or install from your terminal: Run these two commands, then run /reload-plugins in any Claude Code session that is already open.

1claude plugin marketplace add cookiepal/cookiepal-plugin
2claude plugin install cookiepal@cookiepal

Check the connection: Run /mcp in Claude Code. You should see plugin:cookiepal:cookiepal listed as connected. Every CookiePal command starts with /cookiepal:, so typing it lists them all.

Run the command: Run /cookiepal:connect-account. A CookiePal page opens in your browser.

1/cookiepal:connect-account

Sign in or sign up: If you are already signed in to CookiePal in that browser, press Connect and you are done. If not, sign in, continue with Google, or create a free account, then come back to the page and press Connect. Your password never passes through Claude Code.

What you see: Claude tells you the email, the organisation and the default domain it is now connected to. Connecting changes nothing else in your account. Once connected, you can ask Claude which domains your account has, or to add a new one. A domain added this way starts on the free plan, and you can add up to 10 a day.

Install ID question: If you agreed to share an install ID on your first check, you are asked whether to link it to this account, every time you connect. The default is no, and connecting works either way. The link is deleted after 180 days, or when you answer no on a later connect.

When to use it: Run /cookiepal:check-one-page with a page address to find out which cookies and trackers a page sets before a visitor agrees to anything, and what its banner’s accept and reject buttons really do. It works on any page your machine can reach, including localhost and pre-release sites.

1/cookiepal:check-one-page https://example.com

How it works: The page is loaded three times, each in a fresh temporary browser profile on your machine. The arrival pass records what was set before anything was clicked, the accept pass presses the banner’s accept button, and the reject pass presses its reject button. It never presses a button it is unsure of: if it cannot find the banner, or more than one button matches, it reports the arrival pass and says the buttons were not tested.

Reading the result: You get every cookie with its category, every third-party host the page contacted, and what changed between the three passes. Pay most attention to what is still running after reject. The result then explains what was found against the GDPR, the CCPA and CPRA, the LGPD and Quebec’s Law 25, with a separate answer for each law. It never says a site is compliant, and it is not legal advice.

Choosing the format: Add html, markdown or terminal after the address to get a local HTML file, a local Markdown file or the result straight in your terminal. Add artifact to publish it to claude.ai, which asks you first and needs a paid claude.ai plan. With no format, the first check asks whether to publish to claude.ai. The default is no, which keeps a local HTML file, and your answer is remembered. The files from your last 20 checks are kept in the plugin’s data folder. Running the command with a format and no address makes that format your default.

Install ID: The first check asks whether to share a random install ID, so CookiePal can count people rather than checks. The default is no, and the check works either way. Run /cookiepal:check-one-page stop-sharing at any time to stop sharing it, delete the checks stored under it and unlink it from your CookiePal account.

When to use it: Run /cookiepal:run-scan to crawl one of your connected domains and update its cookie report in CookiePal. The crawl runs on your machine, never on CookiePal’s side. It uses your default domain unless you name another. It needs a connected account and a verified banner, except for the first scan of a domain you added from Claude Code.

1/cookiepal:run-scan

Reading the result: A crawl of several pages can take a few minutes, and Claude tells you while it is running. When it finishes, the report is stored in CookiePal labelled a local scan, and Claude says how many pages and cookies it covers. Ask Claude to read the report back for the full cookie list.

If it is refused: A scan of a domain whose banner is not verified is refused, so verify the installation first. A scan is also refused once the domain has used its monthly scan quota: Claude tells you the numbers, and the quota resets at the start of the next month. If the site’s robots.txt blocks the crawl, Claude says which page was blocked and what to allow.

When to use it: Run /cookiepal:detect-stack in your site’s repository to find out which framework it is built with and which file renders the page head, without changing anything. It recognises Next.js, Nuxt, Astro, Vite, Remix, React Router v7, SvelteKit and Shopify themes, and falls back to a custom build.

1/cookiepal:detect-stack

Reading the result: Claude names the framework, the head file and the signal that gave it away. When it says custom build, that is a best guess from your HTML, not a recognised framework. If more than one file could be the head file, it lists them and asks which one your live pages use.

When to use it: Run /cookiepal:install-banner in your site’s repository, once your domain is connected, to add the CookiePal banner tag to your code. It puts the tag in the page head as early as your framework allows, so the banner can block scripts before they load.

1/cookiepal:install-banner

Reading the result: Claude shows the change as a diff and leaves it uncommitted. It never commits or pushes, so review the change, commit it and deploy your site as you normally would. A repository that already has the tag is left as it is, and a tag for a different domain is flagged instead of adding a second banner.

When to use it: Run /cookiepal:match-site-design in your site’s repository to give the banner colours and a position that match your site. It reads your design tokens, such as a Tailwind config, CSS variables or a theme file.

1/cookiepal:match-site-design

Reading the result: Claude proposes the colours and the position, with every colour checked against WCAG AA contrast. Any colour that falls short is adjusted as little as needed, and the change is shown. Nothing is saved until you say yes. If your repository has no design tokens, Claude tells you and your banner keeps its current style.

When to use it: Once your change is deployed, run /cookiepal:verify-installation to confirm the banner is live. It needs a connected account, and checks your home page unless you add a page address, for example /cookiepal:verify-installation https://example.com/shop. It loads your page in a browser on your machine and sets your domain’s installation status in CookiePal. You can also use it just to get your banner tag, if you want to paste it yourself.

1/cookiepal:verify-installation

Verified: The banner is live and your domain shows as installed in CookiePal. If the page loads more than one CookiePal banner script, remove the extra one, because two banners fight over consent.

Failed: Claude gives the reason, such as the tag missing from the page or a tag for another domain. If the tag is there but the banner never ran, another consent tool or a content security policy is usually blocking it. Exempt the CookiePal script from that blocking rather than pasting the tag again.

Inconclusive: The page could not be read, for example because it returned an error, timed out or redirected to another site. Your status in CookiePal is unchanged. Fix the cause and verify again.

When to use it: If your site uses Google tags, run /cookiepal:check-gcm to check that Google Consent Mode is set up correctly. It needs a connected account, and reads your home page unless you add a page address. The page is read on your machine, and the result sets your domain’s Consent Mode status in CookiePal. Run it again as often as you need while you fix a problem: each check replaces the last.

1/cookiepal:check-gcm

Reading the result: Claude either says Consent Mode is set up correctly, or names one of three problems with the fix for it: Consent Mode was not found on the page, its defaults are not set, or the defaults are set too late to take effect. The problem stays on your domain in CookiePal until a check passes.

Pages are loaded on your machine: CookiePal never loads your pages. Cookies are categorised on your machine against the open-source CookiePal cookie catalogue, and the check never opens your own browser profile, so your cookies and sign-ins are never read.

A page check sends: the page’s address without its query string; each cookie’s name, domain, path, expiry, flags and category, but never its value; the third-party hosts; what the accept and reject buttons did; the plugin version; the country the check ran from, worked out from your IP address, which is not stored; and a random install ID only if you agreed to share one.

Other commands send only what they need, when you run them: verifying sends the CookiePal script found on the page, a scan sends the page count and each cookie’s details without values, a Consent Mode check sends the names of its consent entries, and banner changes send the settings you asked for. Banner changes go live straight away, so Claude Code asks you to confirm each one first.

Full detail: Stored checks are deleted after 180 days. Read the privacy notice for everything the plugin sends and keeps, and the terms of service for the hosted service.

Update: Run these commands in your terminal, then run /reload-plugins in any Claude Code session that is already open.

1claude plugin marketplace update cookiepal
2claude plugin update cookiepal@cookiepal

Uninstall: Run these commands to remove the plugin entirely. Uninstalling also removes the install ID from your machine, but not the checks stored under it, so run /cookiepal:check-one-page stop-sharing first if you want those deleted.

1claude plugin uninstall cookiepal@cookiepal
2claude plugin marketplace remove cookiepal

The commands do not appear: Run /reload-plugins, then /mcp, and check that plugin:cookiepal:cookiepal is listed as connected.

No browser was found: Install Google Chrome, Microsoft Edge, Brave or Chromium, or set COOKIEPAL_BROWSER to the executable of the one you have.

Sign-in does not open: Run /mcp, choose cookiepal, choose Authenticate, then run /cookiepal:connect-account again.

Still stuck: Email support@cookiepal.io with the command you ran and what Claude said.