# Cookie Consent Audit (`mambalabs/cookie-consent-audit`) Actor

Check any website for cookie consent problems from an EU address. One row per domain: consent platform, reject button on the first layer, cookies and trackers fired before consent and after reject, and Global Privacy Control response. Signals for privacy teams and DPOs.

- **URL**: https://apify.com/mambalabs/cookie-consent-audit.md
- **Developed by:** [Mamba Labs](https://apify.com/mambalabs) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $42.50 / 1,000 domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Cookie Consent Audit

Check any website for cookie consent problems the way an EU visitor meets them. The actor loads each domain from an EU address in fresh browser sessions: once before any consent click, once after clicking the reject button, and once with Global Privacy Control on. You get one flat row per domain with the consent platform it found, whether a reject button sits on the first layer of the banner, the tracking cookies and tracker requests that fired before consent and after the reject, and how the site responds to Global Privacy Control.

Built for privacy teams, data protection officers, and the agencies that audit sites for them. The output is a list of signals for a human to review. It is not a legal finding.

### Features

- **An EU vantage point.** Banners change by visitor region, so a US address audits the wrong banner. In every browser session, the page itself and every request that decides the banner (the consent platform, Google tags, and consent hosts) go through the Apify proxy in the EU country you pick (Germany by default). Other requests, such as tracker calls and static files, are fetched directly and handed to the browser with its own cookies, so they are still seen and recorded. If no address in that country is available, the actor does not audit the domain from somewhere else; the row says so and is free.
- **Three fresh sessions per domain.** No cookie or browser storage carries from one session to the next: before consent, after reject, and with Global Privacy Control on.
- **Before consent.** Every cookie set and every request sent to a known tracker host before anyone clicks, with vendor and category (analytics, advertising, session replay, marketing automation).
- **First layer controls.** Whether accept and reject (or "necessary only") controls are visible on the first layer of the banner, without opening settings. The actor reads controls inside open shadow roots and frames, and knows the selectors of 17 consent platforms plus accept and reject wording in 16 languages.
- **After reject.** The actor clicks the reject control, reloads the page, and records the tracker requests and new tracking cookies that still appear.
- **Consent platform detection.** IAB TCF (`__tcfapi`, with the CMP ID and `gdprApplies` from a TCF ping), OneTrust, Cookiebot, Usercentrics, Didomi, TrustArc, Quantcast Choice, Sourcepoint, iubenda, Complianz, CookieYes, Osano, Termly, Axeptio, consentmanager, Borlabs Cookie, Klaro, and Google Funding Choices.
- **Google Consent Mode.** Cookieless Consent Mode pings sent with ad and analytics storage denied (`gcs=G100`) are counted on their own, so you can judge them apart from full tracking.
- **Global Privacy Control.** A session that sends `Sec-GPC: 1` and exposes `navigator.globalPrivacyControl`, compared with the plain session, plus a read of `/.well-known/gpc.json`.
- **A fixed, versioned tracker list.** 173 tracker hosts and 83 tracker cookie patterns ship in the actor, and every row names the list version it was checked against, so two audits are comparable.
- **No personal data out.** Cookie names and domains only, never cookie values.

### Input

| Field | Type | Description |
| --- | --- | --- |
| `domain` | string | The website to audit, for example `example.de` or `https://www.example.de/`. The homepage is audited. |
| `domains` | array | More domains or URLs in the same run. Duplicates are skipped. Up to 500 per run. |
| `proxy_country` | select | The EU country the browser connects from: DE, FR, NL, IE, IT, ES, SE, PL, AT, BE, DK, FI, or none. Default DE. none connects without a proxy, which is not an EU vantage point. |
| `check_gpc` | boolean | Also run the Global Privacy Control session and read `/.well-known/gpc.json`. Default true. |
| `max_charge_usd` | number | Stop before the audit charges would pass this amount. |
| `skip_cache` | boolean | A domain audited in the last 24 hours with the same country and GPC setting comes back from cache at no charge. Turn this on to audit it again. Default false. |

### Output

One row per domain. Every row carries every field, with null where a value was not measured.

| Field | Type | Example |
| --- | --- | --- |
| `domain`, `url_audited`, `final_url` | string | `example.de` |
| `vantage_country`, `proxy_used`, `proxy_group` | string, boolean, string | `DE`, true, `residential` |
| `render_status` | string | `rendered`, `blocked`, `timeout`, `unreachable`, `robots_disallowed` |
| `cmp_detected`, `cmp_vendor`, `cmp_vendors_all` | boolean, string, string | true, `onetrust`, `onetrust` |
| `tcf_api_present`, `tcf_cmp_id`, `tcf_gdpr_applies` | boolean, integer, boolean | true, 28, true |
| `banner_detected`, `accept_on_first_layer`, `reject_on_first_layer` | boolean | true, true, false |
| `reject_control_text` | string | `Alle ablehnen` |
| `cookies_before_consent`, `non_essential_cookies_before_consent` | integer | 14, 6 |
| `non_essential_cookies_before_consent_json` | string (JSON list of name, domain, vendor, category) | |
| `tracker_requests_before_consent`, `consent_mode_denied_pings_before_consent` | integer | 23, 0 |
| `tracker_hosts_before_consent_json`, `tracker_vendors_before_consent` | string | `Google Analytics | Meta Pixel` |
| `reject_clicked` | boolean | true |
| `tracker_requests_after_reject`, `consent_mode_denied_pings_after_reject`, `tracker_hosts_after_reject_json` | integer, integer, string | 0, 2 |
| `non_essential_cookies_after_reject`, `non_essential_cookies_after_reject_json` | integer, string | 0 |
| `gpc_checked`, `gpc_tracker_requests`, `gpc_non_essential_cookies`, `gpc_reduces_tracking` | boolean, integer, integer, boolean | true, 20, 6, false |
| `gpc_well_known_found`, `gpc_well_known_gpc` | boolean | false, null |
| `signals`, `signals_count` | string, integer | `trackers_before_consent | no_reject_on_first_layer`, 2 |
| `tracker_list_version` | string | `2026-10-19.1` |
| `from_cache`, `duration_ms` | boolean, integer | false, 41000 |
| `row_status`, `error_reason` | string | `ok`, null |
| `billable_events_json`, `checked_at` | string | `["domain-audited"]` |

The signals are: `trackers_before_consent`, `non_essential_cookies_before_consent`, `no_reject_on_first_layer`, `trackers_after_reject`, `non_essential_cookies_after_reject`, `gpc_no_change`, `no_consent_banner_detected`, and `tcf_gdpr_applies_false_from_eu`.

#### What the signals check, and the rules behind them

- **ePrivacy Directive 2002/58/EC, Article 5(3).** Storing or reading information on a visitor's device needs consent unless it is strictly necessary. The before consent fields show what a site stores and sends before any choice.
- **GDPR, Article 4(11) and Article 7.** Consent must be freely given, specific, informed, and unambiguous, and as easy to withdraw as to give. The after reject fields show whether a refusal is honored.
- **EDPB Cookie Banner Taskforce report, 2023-01-18.** The taskforce lists practices national regulators treat as problems, among them no reject option on the first layer and non essential cookies set before consent. `reject_on_first_layer` and the before consent counts map to those practices.
- **Global Privacy Control.** The GPC specification (w3c.github.io/gpc) defines the `Sec-GPC` header and `/.well-known/gpc.json`. The CCPA regulations treat it as an opt out preference signal for California. The actor reports whether the site sent fewer trackers with GPC on; it does not decide whether a law requires that.

### Pricing

Pay per event. You pay for each domain that was fully audited, plus one small start fee per run.

| Event | Free plan | Starter (Bronze) | Scale (Silver) | Business (Gold) |
| --- | --- | --- | --- | --- |
| `domain-audited`, per audited domain | 0.05 USD (50.00 per 1,000) | 0.0475 USD (47.50 per 1,000) | 0.045 USD (45.00 per 1,000) | 0.0425 USD (42.50 per 1,000) |
| `apify-actor-start`, per run | 0.001 USD | 0.001 USD | 0.001 USD | 0.001 USD |

- Only rows with `row_status` `ok` are charged. Blocked, timed out, partial, unreachable, cached, and invalid input rows are free, and so are the rows of a run where no EU address was available; that run still pays the start fee.
- Free plan cap: 30 audited domains a month on the Apify free plan (1.50 USD of evaluation). After that the run stops with a `cap_reached` row.
- The run stops at the maximum charge you set for it on Apify, and at `max_charge_usd` when you set it.

### Usage examples

**Apify Console or API.** One domain:

```json
{ "domain": "example.de" }
```

A batch audited from France, without the GPC session:

```json
{ "domains": ["example.fr", "example.de", "example.nl"], "proxy_country": "FR", "check_gpc": false }
```

A re-audit of a site you fixed today:

```json
{ "domain": "example.de", "skip_cache": true }
```

**Clay.** Call the actor from an HTTP API column with your Apify token, one domain per row, `{"domain": "{{Domain}}"}`. Every input also works as a string, so `"check_gpc": "false"` is read the same as `false`. Map the flat output fields into columns.

**MCP.** The MCP server `@mambalabsdev/mcp-cookie-consent-audit` exposes the tool `audit_cookie_consent` to Claude, Cursor, and any MCP client.

### Error handling

| Case | What you get |
| --- | --- |
| The site shows a challenge page (Cloudflare, Akamai, DataDome, and similar) | `render_status` `blocked`, `row_status` `blocked`, free |
| The page does not load within 30 seconds | `render_status` `timeout`, free |
| The domain does not resolve or refuses the connection | `render_status` `unreachable`, `row_status` `error`, free |
| `robots.txt` disallows the whole site for every agent | `render_status` `robots_disallowed`, free |
| One of the sessions fails | `row_status` `partial`, with the measured fields filled, free |
| No proxy address in the chosen country | `row_status` `error`, nothing audited, free |
| The whole domain passes its 150 second budget | `row_status` `timeout`, free |
| Not a web domain | `row_status` `invalid_input`, free |

### Limitations

- A row is one sample. Sites change their banner by device, time, and A/B test, and some show it only after a delay or a scroll.
- Automated checks cannot prove compliance. A clean row is not a statement that a site is lawful, and a signal is not a finding that it is not.
- Only the homepage is audited, on a desktop viewport.
- The tracker list is fixed and versioned. A tracker it does not list is not counted; the list grows with new versions, and every row names its version.
- Controls inside closed shadow roots, or banners drawn on a canvas, cannot be read.
- The GPC comparison counts requests. Ad requests vary from load to load, so a small difference is weak evidence.
- Strictly necessary cookies that the list does not recognize are counted in `cookies_before_consent` but not as tracking cookies.

### Mamba Labs suite

Every actor in the suite takes a domain or a company and returns one flat row, so they stack in the same table.

| Actor | Actor ID |
| --- | --- |
| [GTM Hiring Signal Scraper](https://apify.com/mambalabs/gtm-hiring-signal-scraper?fpr=mamba) | `D7O1SA2EqwHGsGr1P` |
| [Tech Stack Signal Detector](https://apify.com/mambalabs/gtm-tech-stack-signal-scraper?fpr=mamba) | `qyd7nNyqFPelQViBx` |
| [GTM Signals Aggregator](https://apify.com/mambalabs/b2b-buying-signals-hiring-tech-stack-intent-for-clay?fpr=mamba) | `xKdRfnfFNkdMpFuNs` |
| [Job Board Keyword Signal Scanner](https://apify.com/mambalabs/job-board-keyword-signal-scanner?fpr=mamba) | `4DvqpvhMR74NLcDDY` |
| [Domain to LinkedIn URL Resolver](https://apify.com/mambalabs/domain-to-linkedin-url-resolver?fpr=mamba) | `3HtnSaqPHOg1Qg5gx` |
| [ICP Fit Scorer](https://apify.com/mambalabs/icp-account-lead-scoring-fit-scorer-0-100-for-clay?fpr=mamba) | `W161DT8W4kW55dMFh` |
| [Domain Deliverability Checker](https://apify.com/mambalabs/domain-deliverability-checker?fpr=mamba) | `0tVgxI7A6o9jMlxmc` |
| [Company Firmographic Enricher](https://apify.com/mambalabs/company-firmographic-enricher?fpr=mamba) | `YlUtLWjfPpqykmB8g` |
| [Company Social Presence Mapper](https://apify.com/mambalabs/company-social-presence-mapper?fpr=mamba) | `4k6CCemkgBDz18m2h` |
| [Company Identity Resolver](https://apify.com/mambalabs/company-identity-resolver?fpr=mamba) | `lr8fTRAmZCBZmuwwh` |
| [Company Change Event Feed](https://apify.com/mambalabs/company-change-event-feed?fpr=mamba) | `oX44rS0fkEJ3rXLWe` |
| [Funding and Press Signal Scanner](https://apify.com/mambalabs/funding-press-signal-scanner?fpr=mamba) | `FS13X6dhQVgX3XOM6` |
| [Job Posting Monitor](https://apify.com/mambalabs/gtm-job-discovery?fpr=mamba) | `QCfICD9kOPiOdj5iI` |
| [Agent Accessibility Auditor](https://apify.com/mambalabs/agent-accessibility-auditor?fpr=mamba) | `anxbRv0lKrpQ1pnua` |
| [AI Tooling Detector](https://apify.com/mambalabs/ai-tooling-detector?fpr=mamba) | `EwkHhmqiuJgRoVEbE` |
| [Prospect Engine](https://apify.com/mambalabs/b2b-prospect-engine?fpr=mamba) | `q9rT6v64nUJdPexOQ` |
| [Publishing Frequency Tracker](https://apify.com/mambalabs/blog-publishing-frequency?fpr=mamba) | `TbLwaUUATdYb6wp4N` |
| [Sequencer Lead Push](https://apify.com/mambalabs/clay-to-instantly-smartlead-push?fpr=mamba) | `0Jv27VeWM5tSZQs9x` |
| [Company Discovery List Builder](https://apify.com/mambalabs/company-discovery-list-builder?fpr=mamba) | `jch0HdaZnpbMqlcGS` |
| [Contact Classifier](https://apify.com/mambalabs/contact-classifier?fpr=mamba) | `0lGSeYJmniXhGANnO` |
| [Work Email Waterfall](https://apify.com/mambalabs/email-waterfall-orchestrator?fpr=mamba) | `OT6xqTFThC0Rjf7Zj` |
| [Event Presence Index](https://apify.com/mambalabs/event-presence-index?fpr=mamba) | `WLhMy8fMDgsxdYxv5` |
| [Legal Entity Resolver](https://apify.com/mambalabs/legal-entity-resolver?fpr=mamba) | `KHFyPCDIx7CyqULYm` |
| [LinkedIn Post Tracker](https://apify.com/mambalabs/linkedin-post-engager-capture?fpr=mamba) | `oiGLNPuaf5BRaz9K5` |
| [Outbound Stack Detector](https://apify.com/mambalabs/outbound-infrastructure-fingerprint?fpr=mamba) | `v43UJC8r7qW7cBSTG` |
| [People Finder & Email Verifier](https://apify.com/mambalabs/people-finder?fpr=mamba) | `LEgloG7tWgQl4o6TD` |
| [Government Contract Award Monitor](https://apify.com/mambalabs/public-award-monitor?fpr=mamba) | `zhEtllASykOcx9hJ8` |
| [Team Page People Extractor](https://apify.com/mambalabs/team-page-people-extractor?fpr=mamba) | `j8a9zX0k4mNbvDbWK` |
| [Workplace Program Detector](https://apify.com/mambalabs/workplace-program-detector?fpr=mamba) | `Li6pPDhqbdzFz3h7G` |
| [Page Finder and Extractor](https://apify.com/mambalabs/page-finder-extractor?fpr=mamba) | `TpurgcOZbVnknlaiC` |
| [Reporting Window Finder](https://apify.com/mambalabs/public-company-reporting-window-finder?fpr=mamba) | `uINxR7a1IW8qUTRUX` |
| [Bluesky Brand Presence Mapper](https://apify.com/mambalabs/bluesky-brand-presence-mapper?fpr=mamba) | `eLpxzP4IuXznlFVND` |
| [Company Contact Details Extractor](https://apify.com/mambalabs/company-contact-details-extractor?fpr=mamba) | `4mMncKaJykiq94grz` |
| [Ecommerce Platform Profiler](https://apify.com/mambalabs/ecommerce-platform-profiler?fpr=mamba) | `5G2NeYjBbQTjaTn9L` |
| [Company Funding Record](https://apify.com/mambalabs/funding-investor-record?fpr=mamba) | `OFS4Mt1gyYNtGfUbE` |
| [GitHub Organization Signal Scanner](https://apify.com/mambalabs/github-organization-signal-scanner?fpr=mamba) | `ahF8RRpv5mzPao5CN` |
| [LinkedIn Company Page Mapper](https://apify.com/mambalabs/linkedin-company-presence-mapper?fpr=mamba) | `zOPm6A9JEhUGcIdFW` |
| [Meta Ad Library Monitor](https://apify.com/mambalabs/meta-ad-library-monitor?fpr=mamba) | `J1GWlSXfSGU3u8Wng` |
| [Instagram Facebook Brand Presence Mapper](https://apify.com/mambalabs/meta-brand-presence-mapper?fpr=mamba) | `HXh65I0JBjPsunbY8` |
| [Pinterest Brand Presence Mapper](https://apify.com/mambalabs/pinterest-brand-presence-mapper?fpr=mamba) | `d1HvjZfKhgvWsoEwn` |
| [Reddit Brand Presence Mapper](https://apify.com/mambalabs/reddit-brand-presence-mapper?fpr=mamba) | `pKQZmDaT70SEb54bZ` |
| [Trustpilot Reputation Enricher](https://apify.com/mambalabs/review-platform-reputation-enricher?fpr=mamba) | `3lIqfCt61j4hqE1xz` |
| [TikTok Brand Presence Mapper](https://apify.com/mambalabs/tiktok-brand-presence-mapper?fpr=mamba) | `fco8FvoJcSafbeyd1` |
| [Website Traffic Rank Estimator](https://apify.com/mambalabs/website-traffic-rank-estimator?fpr=mamba) | `GnOFUzlNVIoXgeJjH` |
| [X Brand Presence Mapper](https://apify.com/mambalabs/x-brand-presence-mapper?fpr=mamba) | `oLOgadhHUkNAyDA3w` |
| [YouTube Channel Stats Extractor](https://apify.com/mambalabs/youtube-channel-transcript-extractor?fpr=mamba) | `6hSpD3kd2s2IQ4VSs` |
| [Influencer Change Monitor](https://apify.com/mambalabs/creator-change-monitor?fpr=mamba) | `d2VVgahNL6UmcLkhg` |
| [Influencer Finder](https://apify.com/mambalabs/creator-finder?fpr=mamba) | `tpkedmloIIWtXx6sg` |
| [Influencer Lead List Builder](https://apify.com/mambalabs/creator-lead-list-all-in-one?fpr=mamba) | `KnmByszcv135yM30G` |
| [Influencer Profile Scraper](https://apify.com/mambalabs/creator-profile-reader?fpr=mamba) | `EqEnklDVMIcB1V499` |
| [Link in Bio Scraper and Newsletter Detector](https://apify.com/mambalabs/link-in-bio-newsletter-checker?fpr=mamba) | `OorucdheTIgu7RFzK` |
| [Influencer Talent Agency Lookup](https://apify.com/mambalabs/talent-agency-lookup?fpr=mamba) | `zCuX4Mgyg6JvXgGzd` |
| [Expert Witness Directory](https://apify.com/mambalabs/expert-witness-directory?fpr=mamba) | `LIpwlgfE3LaQBaXd4` |
| [Account Hiring Watch](https://apify.com/mambalabs/account-hiring-watch?fpr=mamba) | `gRAZA5WBi1r6L0gy7` |
| [Career Change Signal Engine](https://apify.com/mambalabs/career-change-signal-engine?fpr=mamba) | `vX2Yga1a6wGaXaP14` |
| [Job Change Tracker](https://apify.com/mambalabs/job-change-tracker?fpr=mamba) | `L8UbEmMJC1XYPSZOb` |
| [New Hire Finder](https://apify.com/mambalabs/new-hire-finder?fpr=mamba) | `cKuc38p4nYHNF3IW8` |

Shared code: [@mambalabsdev/gtm-core](https://www.npmjs.com/package/@mambalabsdev/gtm-core) (output validation).

> **Sourcing and legal.** The actor loads public web pages the way a visitor's browser does, with the page and its banner deciding requests sent through the Apify proxy. No login is used. It returns cookie names and request hosts, never cookie values or personal data. You are responsible for how you use the output.

Built by [Mamba Labs](https://apify.com/mambalabs).

# Actor input Schema

## `domain` (type: `string`):

The website to audit, for example example.de or https://www.example.de/. The homepage is audited.

## `domains` (type: `array`):

More domains or URLs to audit in the same run, one per line. Duplicates are skipped. Up to 500 per run.

## `proxy_country` (type: `string`):

The country the browser connects from. Consent banners change by visitor region, so audit from the market you care about. Choose none to connect without a proxy, which is not an EU vantage point.

## `check_gpc` (type: `boolean`):

Load the site once more with the Global Privacy Control signal on (the Sec-GPC header and navigator.globalPrivacyControl) and compare trackers with the plain visit. Also reads /.well-known/gpc.json.

## `max_charge_usd` (type: `number`):

Stop the run before the audit charges would pass this amount. Leave empty for no cap beyond the run's own maximum charge.

## `skip_cache` (type: `boolean`):

A domain audited in the last 24 hours with the same country and GPC setting is returned from cache at no charge. Turn this on to audit it again.

## `source_tag` (type: `string`):

Internal attribution tag. Leave empty.

## `debug` (type: `boolean`):

Internal. Saves request lists to the run's key value store.

## `direct_assets` (type: `boolean`):

Internal. Fetch requests that do not decide the banner (tracker calls, static files) without the proxy and hand them to the browser.

## Actor input object example

```json
{
  "domain": "cookiebot.com",
  "proxy_country": "DE",
  "check_gpc": true,
  "skip_cache": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `runSummary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domain": "cookiebot.com"
};

// Run the Actor and wait for it to finish
const run = await client.actor("mambalabs/cookie-consent-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domain": "cookiebot.com" }

# Run the Actor and wait for it to finish
run = client.actor("mambalabs/cookie-consent-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domain": "cookiebot.com"
}' |
apify call mambalabs/cookie-consent-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mambalabs/cookie-consent-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/TrKyOS0KBoGC35nbr/builds/XZPSCL8PRp3FhYNAM/openapi.json