Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add capazme/mcp-legal-it/plugin install legal-itWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/capazme/mcp-legal-it/cookie-audit)<a href="https://agentmods.dev/skills/capazme/mcp-legal-it/cookie-audit"><img src="https://agentmods.dev/badge/skills/capazme/mcp-legal-it/cookie-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/capazme/mcp-legal-it/cookie-audit"><img src="https://agentmods.dev/badge/skills/capazme/mcp-legal-it/cookie-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00258 | $0.02529 |
| Opus 5 | $0.00129 | $0.01264 |
| Sonnet 5 | $0.00052 | $0.00506 |
| Haiku 4.5 | $0.00026 | $0.00253 |
Grade A, and why
cookie-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Se il sito usa GTM (container `GTM-XXXXXXX`), **scarica il container lato server** con `curl` (nessun ad-blocker) ed estrai gli ID reali dei tag. È la fonte più affidabile per sapere *cosa* il sito installa davvero: How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cookie Audit — analisi forense dei cookie di un sito
Produce un'analisi tecnico-legale dei cookie e degli strumenti di tracciamento di un sito pubblico, con la stessa rigorosità di un accertamento privacy: non ci si limita a leggere la cookie policy dichiarata (spesso auto-generata e imprecisa), ma si osserva il comportamento reale del sito nel browser, distinguendo ciò che accade prima e dopo il consenso.
Cosa produce
- Tabella cookie unica — nome · fornitore/dominio · finalità · durata · categoria · stato (osservato / atteso / condizionale).
- Inventario tracker — CMP usata, container GTM, ID di misurazione/conversione reali (GA4, Ads, Meta, LinkedIn…).
- Valutazione di conformità — contro il Provvedimento del Garante 10.6.2021, il GDPR e l'art. 122 Cod. Privacy (vedi
references/compliance-checklist.md). - Report Word su richiesta (
scripts/generate_report.js). - Remediation su richiesta — bozza di cookie policy allineata allo stack reale + checklist di adeguamento.
Principio cardine
Il test decisivo del diritto italiano/UE è: nessun cookie non tecnico (né chiamata a terze parti non necessarie) prima di un consenso libero e specifico (art. 122 Cod. Privacy, che recepisce l'art. 5(3) Dir. ePrivacy). Tutto il metodo ruota attorno a verificare empiricamente questo.
Metodo
Setup del browser
Serve un MCP browser che sappia (a) navigare, (b) eseguire JavaScript nella pagina, (c) leggere le richieste di rete. Vanno bene chrome-devtools (mcp__chrome-devtools__*) o claude-in-chrome (mcp__claude-in-chrome__*); carica i tool via ToolSearch se sono deferred. Preferire chrome-devtools quando disponibile (contesto isolato + lettura rete più semplice).
Apri il sito in un contesto isolato/pulito (nessun cookie pregresso) — es. new_page({url, isolatedContext:"cookieaudit"}). Un contesto sporco falsa la Fase 1.
⚠️ Caveat ad-blocker (leggi sempre). Molti browser hanno uBlock Origin o simili. Un ad-blocker: blocca il CSS cookieblocker, nasconde cosmeticamente il banner (display:none), sostituisce gtm.js/gtag/js con uno stub e blocca gli endpoint analytics. Sintomi: _ga non compare dopo il consenso, gtm.js pesa pochi KB, richieste net::ERR_BLOCKED_BY_CLIENT. In tal caso le osservazioni pre-consenso restano valide, ma per l'inventario reale non fidarti del browser: usa la Fase 3-bis (container GTM lato server). Dichiara sempre questo caveat nel report e marca le voci non osservate come «Atteso».
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 92 lines · 258 tokens per session scan A bd489e5a1877
cookie-audit is a skill published in the GitHub repository capazme/mcp-legal-it (15 stars, last pushed today), licensed Apache-2.0. It adds 258 tokens to every session and 2,529 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cmdb-patterns
Create ServiceNow CIs and cmdbrelci relationships, walk upstream/downstream impact, detect orphan/stale CIs, and align discovered CIs with the proper sysclassname hierarchy.
blast-radius
Trace ServiceNow configuration dependencies — what artifacts touch a given field, what calls a script include, table/app-level config inventory. Use before deletes, renames, or refactors.
change-management
Create and transition ServiceNow change requests (normal/standard/emergency), change tasks, affected CIs, approval routing, CAB scheduling, and conflict detection across maintenance windows.
discovery-patterns
Configure ServiceNow Discovery — schedules, IP ranges, credential affinities, MID Server assignment, custom probes/sensors, identification rules, and run-status monitoring on discovery tables.
incident-management
Manage ServiceNow incidents — creation with impact/urgency priority calc, auto-assignment by category, reassignment tracking, major incident declaration with bridge calls, time-based escalation, MTTR metrics.
notification-events
Use ServiceNow events (sysevent) — gs.eventQueue dispatch, syseventregister definitions, syseventscriptaction handlers, delayed events with processon, and reminder/state-change patterns.