gridwork-privacy
OfficialAllows auditing websites for the presence and GDPR compliance of Facebook Pixel and related trackers.
Allows auditing websites for the presence and GDPR compliance of Google Analytics trackers.
Allows auditing websites for the presence and GDPR compliance of TikTok trackers.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@gridwork-privacyaudit example.com for GDPR compliance"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
gridwork-privacy
MCP server that audits websites for GDPR, CCPA, and ePrivacy compliance.
What it does
Detects 30+ third-party trackers (Google Analytics, Facebook Pixel, TikTok, Criteo, etc.)
Analyzes cookie consent mechanisms (CMP detection, reject options, pre-checked boxes)
Checks privacy policy presence and required disclosures
Reviews data collection forms for sensitive fields
Classifies each tracker's GDPR concern level
Identifies specific regulatory articles for each finding
Related MCP server: aadc-audit-mcp
Install
npx gridwork-privacyMCP tools
Tool | Description |
| Full privacy audit — trackers, consent, policy, data collection |
| Quick tracker detection with GDPR concerns |
| Cookie consent mechanism compliance check |
| Side-by-side privacy comparison of two sites |
Claude Desktop config
{
"mcpServers": {
"gridwork-privacy": {
"command": "npx",
"args": ["-y", "gridwork-privacy"]
}
}
}License
MIT — Gridwork
Available Tools
4 toolsaudit_privacyA
Run a comprehensive privacy audit on a website. Detects trackers (Google Analytics, Facebook Pixel, etc.), analyzes cookie consent mechanisms, checks privacy policy compliance, and reviews data collection forms. Evaluates against GDPR, CCPA, and ePrivacy Directive.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The URL to audit (e.g., https://example.com) | |
| format | No | Output format | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose whether the tool is read-only, requires authentication, or has rate limits. It describes what is detected but not the operation's side effects or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences convey the full purpose and scope with no redundant words. The description is efficiently front-loaded with the verb 'Run a comprehensive privacy audit' followed by specific details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only 2 parameters and no output schema, the description adequately covers the tool's functionality, checks, and regulations. It lacks behavioral context but is otherwise complete for an audit tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds value by explaining what the audit covers (trackers, consent, etc.), but it does not add detail to the parameters themselves beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the tool's purpose as running a comprehensive privacy audit on a website, listing specific checks (trackers, cookie consent, privacy policy, forms) and regulations (GDPR, CCPA, ePrivacy). It clearly distinguishes from narrower sibling tools like scan_trackers or check_consent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for full audits but does not explicitly state when to use it versus alternatives (e.g., scan_trackers for specific trackers). No when-not guidance is provided, but the context of 'comprehensive' gives some implicit direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_consentA
Check if a website's cookie consent mechanism meets GDPR and ePrivacy requirements. Detects CMP platforms, reject options, pre-checked boxes, and cookie walls.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The URL to check |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It states what the tool checks but does not disclose behavioral traits like whether it is read-only, requires authentication, or has rate limits. The output format is not described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main action, followed by specific detection items. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description covers the tool's purpose, it lacks details on return value format, error handling, or scope (e.g., whether it checks only the given URL or embedded resources). No output schema is provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%; the parameter 'url' is described in schema. The description adds context about consent checking but does not add detail beyond what the schema provides for the parameter itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks cookie consent mechanisms for GDPR and ePrivacy compliance and lists specific elements detected (CMP platforms, reject options, etc.). It distinguishes from siblings like scan_trackers which focus on general trackers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for consent compliance checks but does not explicitly state when to use this tool vs alternatives, nor does it mention prerequisites or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compare_privacyA
Compare privacy practices of two websites side by side. Shows trackers, consent compliance, and overall scores for both.
| Name | Required | Description | Default |
|---|---|---|---|
| url_a | Yes | First URL to compare | |
| url_b | Yes | Second URL to compare |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that the tool outputs trackers, consent compliance, and scores, giving a clear behavioral idea. However, it does not mention if it makes external network requests, rate limits, or other side effects. It is fairly transparent for a read-only tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose. No unnecessary words. Every sentence contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description outlines key outputs. However, it lacks detail on the comparison format, scoring detail, or error handling. More completeness would aid agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with minimal descriptions. The tool description does not add extra meaning beyond the schema (e.g., URL format expectations). Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: comparing privacy practices of two websites side by side. It specifies what it shows (trackers, consent compliance, overall scores), and it effectively differentiates from siblings like scan_trackers and check_consent which likely operate on single sites.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for comparing two websites but does not provide explicit guidance on when to use this tool versus alternatives like scan_trackers or check_consent. It lacks when-not or exclusionary criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_trackersA
Quick scan to detect third-party trackers on a website. Lists all advertising, analytics, social, and fingerprinting trackers found with GDPR concerns for each.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The URL to scan |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must fully disclose behavior. It states it is a 'quick scan' and lists output contents (tracker types and GDPR concerns) but does not address side effects, rate limits, authentication needs, or response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words, front-loaded with the verb 'scan', and immediately conveys the tool's core function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description adequately explains the purpose and high-level output (list of tracker types with GDPR concerns). It does not cover error handling or edge cases but is sufficient for a quick scan tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single 'url' property described as 'The URL to scan'. The tool description adds context that it scans a website but does not provide additional parameter semantics beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans for third-party trackers on a website and lists specific types (advertising, analytics, social, fingerprinting) with GDPR concerns, distinguishing it from sibling tools like check_consent or audit_privacy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs siblings (check_consent, compare_privacy, audit_privacy). The description mentions 'quick scan' but does not specify when not to use it or provide alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v1.1.0- First observed
audit_privacy - First observed
check_consent - First observed
compare_privacy - First observed
scan_trackers
TDQS
Each tool has a clearly distinct purpose: scan_trackers detects trackers, check_consent evaluates consent mechanisms, compare_privacy compares two sites, and audit_privacy performs a comprehensive audit. No overlap or ambiguity.
All tool names follow a consistent verb_noun pattern: scan_trackers, check_consent, compare_privacy, audit_privacy. The verbs ('scan', 'check', 'compare', 'audit') are distinct and the nouns are clear.
With 4 tools, the set is well-scoped for a privacy analysis server: quick scan, consent check, comparison, and comprehensive audit. Each tool earns its place without being excessive or insufficient.
The tool surface covers the core privacy analysis workflow: tracker detection, consent evaluation, comparison, and full audit. There are no obvious missing operations for the domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for detecting and redacting PII (Personally Identifiable Information) in PDF documents.
AI governance MCP server for EU AI Act compliance and jurisdiction verification
Conformance checker for MCP servers. Free, no key, verdicts recomputable and re-measured daily.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceMCP server for children's privacy compliance, enabling checks under COPPA, FERPA, UK Age Appropriate Design Code, and EU AI Act provisions for minors.1MIT
- AlicenseAqualityBmaintenanceA local MCP server that audits software projects against the UK ICO Age Appropriate Design Code (Children's Code) entirely on the user's machine.1525MIT
- AlicenseAqualityDmaintenanceMCP server for querying compliance regulations including GDPR, EU AI Act, and CCPA through natural language questions, keyword search, and compliance checks.619MIT
- FlicenseAqualityDmaintenanceAn MCP server that audits websites for accessibility (WCAG 2.1 AA/EAA), performance, SEO, design quality, and mobile responsiveness, providing actionable scores, grades, and prioritized fixes.6-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/thegridwork/privacy'
If you have feedback or need assistance with the MCP directory API, please join our Discord server