From 7bc8343c18cf748b58cd5bff1342c3c84c055f40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Fri, 1 May 2026 14:59:33 +0400
Subject: [PATCH] Add MCP tools for cookie banner, category, pattern, version,
 and consent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wire cookiebanner.Service into the MCP resolver and expose 24 tools
covering full CRUD, activation, versioning, translations, and consent
record queries with pagination and filtering support.

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 .../overview/CookieBannersOverviewPage.tsx    |    2 +-
 pkg/server/api/api.go                         |    1 +
 pkg/server/api/mcp/v1/resolver.go             |    2 +
 pkg/server/api/mcp/v1/schema.resolvers.go     |  335 ++++++
 pkg/server/api/mcp/v1/specification.yaml      | 1060 +++++++++++++++++
 pkg/server/api/mcp/v1/types/cookie_banner.go  |   67 ++
 .../api/mcp/v1/types/cookie_banner_version.go |   49 +
 .../api/mcp/v1/types/cookie_category.go       |   61 +
 .../api/mcp/v1/types/cookie_consent_record.go |   58 +
 pkg/server/api/mcp/v1/types/cookie_pattern.go |   55 +
 pkg/server/api/mcp/v1/v1_handler.go           |    4 +-
 11 files changed, 1692 insertions(+), 2 deletions(-)
 create mode 100644 pkg/server/api/mcp/v1/types/cookie_banner.go
 create mode 100644 pkg/server/api/mcp/v1/types/cookie_banner_version.go
 create mode 100644 pkg/server/api/mcp/v1/types/cookie_category.go
 create mode 100644 pkg/server/api/mcp/v1/types/cookie_consent_record.go
 create mode 100644 pkg/server/api/mcp/v1/types/cookie_pattern.go

diff --git a/apps/console/src/pages/organizations/cookie-banners/overview/CookieBannersOverviewPage.tsx b/apps/console/src/pages/organizations/cookie-banners/overview/CookieBannersOverviewPage.tsx
index e859ccb1e..1a1134372 100644
--- a/apps/console/src/pages/organizations/cookie-banners/overview/CookieBannersOverviewPage.tsx
+++ b/apps/console/src/pages/organizations/cookie-banners/overview/CookieBannersOverviewPage.tsx
@@ -174,7 +174,7 @@ export function CookieBannersOverviewPage({ queryRef }: CookieBannersOverviewPag
           <Button to={newBannerHref}>{__("Create Banner")}</Button>
         </div>
 
-        <Card className="divide-y divide-border rounded-lg border">
+        <Card className="divide-y divide-border-low rounded-lg">
           {banners.map(banner => (
             <Link
               key={banner.id}
diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go
index cc40b4366..eab92b025 100644
--- a/pkg/server/api/api.go
+++ b/pkg/server/api/api.go
@@ -202,6 +202,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.Probo,
 			cfg.IAM,
 			cfg.AccessReview,
+			cfg.CookieBanner,
 			cfg.TokenSecret,
 		),
 		slackHandler: slack_v1.NewMux(
diff --git a/pkg/server/api/mcp/v1/resolver.go b/pkg/server/api/mcp/v1/resolver.go
index aae168ef4..171e6a52c 100644
--- a/pkg/server/api/mcp/v1/resolver.go
+++ b/pkg/server/api/mcp/v1/resolver.go
@@ -23,6 +23,7 @@ import (
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
+	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/probo"
@@ -34,6 +35,7 @@ type Resolver struct {
 	proboSvc     *probo.Service
 	iamSvc       *iam.Service
 	accessReview *accessreview.Service
+	cookieBanner *cookiebanner.Service
 	logger       *log.Logger
 }
 
diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go
index fd0745367..f98e628e7 100644
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -6,12 +6,14 @@ package mcp_v1
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"time"
 
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"go.probo.inc/probo/pkg/accessreview"
+	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
@@ -4852,3 +4854,336 @@ func (r *Resolver) PublishVendorListTool(ctx context.Context, req *mcp.CallToolR
 		DocumentVersionID: documentVersion.ID,
 	}, nil
 }
+
+func (r *Resolver) ListCookieBannersTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieBannersInput) (*mcp.CallToolResult, types.ListCookieBannersOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionCookieBannerList)
+	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
+	cursor := types.NewCursor(input.Size, input.Cursor, page.OrderBy[coredata.CookieBannerOrderField]{Field: coredata.CookieBannerOrderFieldCreatedAt, Direction: page.OrderDirectionDesc})
+	banners, err := r.cookieBanner.ListCookieBannersForOrganization(ctx, scope, input.OrganizationID, cursor, coredata.NewCookieBannerFilter(nil))
+	if err != nil {
+		panic(fmt.Errorf("cannot list cookie banners: %w", err))
+	}
+	p := page.NewPage(banners, cursor)
+	return nil, types.NewListCookieBannersOutput(p), nil
+}
+
+func (r *Resolver) GetCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookieBannerInput) (*mcp.CallToolResult, types.GetCookieBannerOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieBannerGet)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	banner, err := r.cookieBanner.GetCookieBanner(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.GetCookieBannerOutput{}, fmt.Errorf("cannot get cookie banner: %w", err)
+	}
+	return nil, types.GetCookieBannerOutput{CookieBanner: types.NewCookieBanner(banner)}, nil
+}
+
+func (r *Resolver) AddCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddCookieBannerInput) (*mcp.CallToolResult, types.AddCookieBannerOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate)
+	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
+	banner, err := r.cookieBanner.CreateCookieBanner(ctx, scope, cookiebanner.CreateCookieBannerRequest{
+		OrganizationID:    input.OrganizationID,
+		Name:              input.Name,
+		Origin:            input.Origin,
+		PrivacyPolicyURL:  input.PrivacyPolicyURL,
+		CookiePolicyURL:   input.CookiePolicyURL,
+		ConsentExpiryDays: input.ConsentExpiryDays,
+		ConsentMode:       coredata.CookieConsentMode(input.ConsentMode),
+	})
+	if err != nil {
+		return nil, types.AddCookieBannerOutput{}, fmt.Errorf("cannot create cookie banner: %w", err)
+	}
+	return nil, types.AddCookieBannerOutput{CookieBanner: types.NewCookieBanner(banner)}, nil
+}
+
+func (r *Resolver) UpdateCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateCookieBannerInput) (*mcp.CallToolResult, types.UpdateCookieBannerOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieBannerUpdate)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+
+	updateReq := cookiebanner.UpdateCookieBannerRequest{CookieBannerID: input.ID}
+	if v := UnwrapOmittable(input.Name); v != nil && *v != nil {
+		updateReq.Name = *v
+	}
+	if v := UnwrapOmittable(input.PrivacyPolicyURL); v != nil && *v != nil {
+		updateReq.PrivacyPolicyURL = *v
+	}
+	if v := UnwrapOmittable(input.CookiePolicyURL); v != nil && *v != nil {
+		updateReq.CookiePolicyURL = *v
+	}
+	if v := UnwrapOmittable(input.ConsentExpiryDays); v != nil && *v != nil {
+		updateReq.ConsentExpiryDays = *v
+	}
+	if v := UnwrapOmittable(input.ConsentMode); v != nil && *v != nil {
+		mode := coredata.CookieConsentMode(**v)
+		updateReq.ConsentMode = &mode
+	}
+	if v := UnwrapOmittable(input.DefaultLanguage); v != nil && *v != nil {
+		updateReq.DefaultLanguage = *v
+	}
+
+	banner, err := r.cookieBanner.UpdateCookieBanner(ctx, scope, updateReq)
+	if err != nil {
+		return nil, types.UpdateCookieBannerOutput{}, fmt.Errorf("cannot update cookie banner: %w", err)
+	}
+	return nil, types.UpdateCookieBannerOutput{CookieBanner: types.NewCookieBanner(banner)}, nil
+}
+
+func (r *Resolver) DeleteCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCookieBannerInput) (*mcp.CallToolResult, types.DeleteCookieBannerOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieBannerDelete)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	if err := r.cookieBanner.DeleteCookieBanner(ctx, scope, input.ID); err != nil {
+		return nil, types.DeleteCookieBannerOutput{}, fmt.Errorf("cannot delete cookie banner: %w", err)
+	}
+	return nil, types.DeleteCookieBannerOutput{DeletedID: input.ID}, nil
+}
+
+func (r *Resolver) ActivateCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ActivateCookieBannerInput) (*mcp.CallToolResult, types.ActivateCookieBannerOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieBannerActivate)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	banner, err := r.cookieBanner.ActivateCookieBanner(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.ActivateCookieBannerOutput{}, fmt.Errorf("cannot activate cookie banner: %w", err)
+	}
+	return nil, types.ActivateCookieBannerOutput{CookieBanner: types.NewCookieBanner(banner)}, nil
+}
+
+func (r *Resolver) DeactivateCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeactivateCookieBannerInput) (*mcp.CallToolResult, types.DeactivateCookieBannerOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieBannerDeactivate)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	banner, err := r.cookieBanner.DeactivateCookieBanner(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.DeactivateCookieBannerOutput{}, fmt.Errorf("cannot deactivate cookie banner: %w", err)
+	}
+	return nil, types.DeactivateCookieBannerOutput{CookieBanner: types.NewCookieBanner(banner)}, nil
+}
+
+func (r *Resolver) ListCookieCategoriesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieCategoriesInput) (*mcp.CallToolResult, types.ListCookieCategoriesOutput, error) {
+	r.MustAuthorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryList)
+	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
+	cursor := types.NewCursor(input.Size, input.Cursor, page.OrderBy[coredata.CookieCategoryOrderField]{Field: coredata.CookieCategoryOrderFieldRank, Direction: page.OrderDirectionAsc})
+	categories, err := r.cookieBanner.ListCookieCategoriesForBanner(ctx, scope, input.CookieBannerID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list cookie categories: %w", err))
+	}
+	p := page.NewPage(categories, cursor)
+	return nil, types.NewListCookieCategoriesOutput(p), nil
+}
+
+func (r *Resolver) GetCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookieCategoryInput) (*mcp.CallToolResult, types.GetCookieCategoryOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieCategoryGet)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	category, err := r.cookieBanner.GetCookieCategory(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.GetCookieCategoryOutput{}, fmt.Errorf("cannot get cookie category: %w", err)
+	}
+	return nil, types.GetCookieCategoryOutput{CookieCategory: types.NewCookieCategory(category)}, nil
+}
+
+func (r *Resolver) AddCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddCookieCategoryInput) (*mcp.CallToolResult, types.AddCookieCategoryOutput, error) {
+	r.MustAuthorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate)
+	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
+	category, err := r.cookieBanner.CreateCookieCategory(ctx, scope, cookiebanner.CreateCookieCategoryRequest{
+		CookieBannerID: input.CookieBannerID,
+		Name:           input.Name,
+		Slug:           input.Slug,
+		Description:    input.Description,
+		Rank:           input.Rank,
+	})
+	if err != nil {
+		return nil, types.AddCookieCategoryOutput{}, fmt.Errorf("cannot create cookie category: %w", err)
+	}
+	return nil, types.AddCookieCategoryOutput{CookieCategory: types.NewCookieCategory(category)}, nil
+}
+
+func (r *Resolver) UpdateCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateCookieCategoryInput) (*mcp.CallToolResult, types.UpdateCookieCategoryOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieCategoryUpdate)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	updateReq := cookiebanner.UpdateCookieCategoryRequest{CookieCategoryID: input.ID}
+	if v := UnwrapOmittable(input.Name); v != nil && *v != nil {
+		updateReq.Name = *v
+	}
+	if v := UnwrapOmittable(input.Slug); v != nil && *v != nil {
+		updateReq.Slug = *v
+	}
+	if v := UnwrapOmittable(input.Description); v != nil && *v != nil {
+		updateReq.Description = *v
+	}
+	category, err := r.cookieBanner.UpdateCookieCategory(ctx, scope, updateReq)
+	if err != nil {
+		return nil, types.UpdateCookieCategoryOutput{}, fmt.Errorf("cannot update cookie category: %w", err)
+	}
+	return nil, types.UpdateCookieCategoryOutput{CookieCategory: types.NewCookieCategory(category)}, nil
+}
+
+func (r *Resolver) DeleteCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCookieCategoryInput) (*mcp.CallToolResult, types.DeleteCookieCategoryOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieCategoryDelete)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	if err := r.cookieBanner.DeleteCookieCategory(ctx, scope, input.ID); err != nil {
+		return nil, types.DeleteCookieCategoryOutput{}, fmt.Errorf("cannot delete cookie category: %w", err)
+	}
+	return nil, types.DeleteCookieCategoryOutput{DeletedID: input.ID}, nil
+}
+
+func (r *Resolver) ReorderCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ReorderCookieCategoryInput) (*mcp.CallToolResult, types.ReorderCookieCategoryOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieCategoryUpdate)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	_, err := r.cookieBanner.ReorderCookieCategory(ctx, scope, cookiebanner.ReorderCookieCategoryRequest{
+		CookieCategoryID: input.ID,
+		Rank:             input.Rank,
+	})
+	if err != nil {
+		return nil, types.ReorderCookieCategoryOutput{}, fmt.Errorf("cannot reorder cookie category: %w", err)
+	}
+	category, err := r.cookieBanner.GetCookieCategory(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.ReorderCookieCategoryOutput{}, fmt.Errorf("cannot get cookie category: %w", err)
+	}
+	return nil, types.ReorderCookieCategoryOutput{CookieCategory: types.NewCookieCategory(category)}, nil
+}
+
+func (r *Resolver) ListCookiePatternsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookiePatternsInput) (*mcp.CallToolResult, types.ListCookiePatternsOutput, error) {
+	r.MustAuthorize(ctx, input.CookieCategoryID, probo.ActionCookiePatternList)
+	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
+	cursor := types.NewCursor(input.Size, input.Cursor, page.OrderBy[coredata.CookiePatternOrderField]{Field: coredata.CookiePatternOrderFieldCreatedAt, Direction: page.OrderDirectionAsc})
+	patterns, err := r.cookieBanner.ListCookiePatternsForCategory(ctx, scope, input.CookieCategoryID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list cookie patterns: %w", err))
+	}
+	p := page.NewPage(patterns, cursor)
+	return nil, types.NewListCookiePatternsOutput(p), nil
+}
+
+func (r *Resolver) GetCookiePatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookiePatternInput) (*mcp.CallToolResult, types.GetCookiePatternOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookiePatternGet)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	pattern, err := r.cookieBanner.GetCookiePattern(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.GetCookiePatternOutput{}, fmt.Errorf("cannot get cookie pattern: %w", err)
+	}
+	return nil, types.GetCookiePatternOutput{CookiePattern: types.NewCookiePattern(pattern)}, nil
+}
+
+func (r *Resolver) AddCookiePatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddCookiePatternInput) (*mcp.CallToolResult, types.AddCookiePatternOutput, error) {
+	r.MustAuthorize(ctx, input.CookieCategoryID, probo.ActionCookiePatternCreate)
+	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
+	pattern, err := r.cookieBanner.CreateCookiePattern(ctx, scope, cookiebanner.CreateCookiePatternRequest{
+		CookieCategoryID: input.CookieCategoryID,
+		Pattern:          input.Pattern,
+		MatchType:        coredata.CookiePatternMatchType(input.MatchType),
+		DisplayName:      input.DisplayName,
+		MaxAgeSeconds:    input.MaxAgeSeconds,
+		Description:      input.Description,
+	})
+	if err != nil {
+		return nil, types.AddCookiePatternOutput{}, fmt.Errorf("cannot create cookie pattern: %w", err)
+	}
+	return nil, types.AddCookiePatternOutput{CookiePattern: types.NewCookiePattern(pattern)}, nil
+}
+
+func (r *Resolver) UpdateCookiePatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateCookiePatternInput) (*mcp.CallToolResult, types.UpdateCookiePatternOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookiePatternUpdate)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	updateReq := cookiebanner.UpdateCookiePatternRequest{CookiePatternID: input.ID}
+	if v := UnwrapOmittable(input.DisplayName); v != nil && *v != nil {
+		updateReq.DisplayName = *v
+	}
+	if input.MaxAgeSeconds.IsSet() {
+		val, _ := input.MaxAgeSeconds.Value()
+		updateReq.MaxAgeSeconds = &val
+	}
+	if v := UnwrapOmittable(input.Description); v != nil && *v != nil {
+		updateReq.Description = *v
+	}
+	pattern, err := r.cookieBanner.UpdateCookiePattern(ctx, scope, updateReq)
+	if err != nil {
+		return nil, types.UpdateCookiePatternOutput{}, fmt.Errorf("cannot update cookie pattern: %w", err)
+	}
+	return nil, types.UpdateCookiePatternOutput{CookiePattern: types.NewCookiePattern(pattern)}, nil
+}
+
+func (r *Resolver) DeleteCookiePatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCookiePatternInput) (*mcp.CallToolResult, types.DeleteCookiePatternOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookiePatternDelete)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	if err := r.cookieBanner.DeleteCookiePattern(ctx, scope, input.ID); err != nil {
+		return nil, types.DeleteCookiePatternOutput{}, fmt.Errorf("cannot delete cookie pattern: %w", err)
+	}
+	return nil, types.DeleteCookiePatternOutput{DeletedID: input.ID}, nil
+}
+
+func (r *Resolver) MoveCookiePatternToCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.MoveCookiePatternToCategoryInput) (*mcp.CallToolResult, types.MoveCookiePatternToCategoryOutput, error) {
+	r.MustAuthorize(ctx, input.CookiePatternID, probo.ActionCookiePatternUpdate)
+	scope := coredata.NewScopeFromObjectID(input.CookiePatternID)
+	result, err := r.cookieBanner.MoveCookiePatternToCategory(ctx, scope, cookiebanner.MoveCookiePatternToCategoryRequest{
+		CookiePatternID:        input.CookiePatternID,
+		TargetCookieCategoryID: input.TargetCookieCategoryID,
+	})
+	if err != nil {
+		return nil, types.MoveCookiePatternToCategoryOutput{}, fmt.Errorf("cannot move cookie pattern: %w", err)
+	}
+	return nil, types.MoveCookiePatternToCategoryOutput{CookiePattern: types.NewCookiePattern(result.CookiePattern)}, nil
+}
+
+func (r *Resolver) PublishCookieBannerVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishCookieBannerVersionInput) (*mcp.CallToolResult, types.PublishCookieBannerVersionOutput, error) {
+	r.MustAuthorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish)
+	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
+	version, err := r.cookieBanner.PublishCookieBannerVersion(ctx, scope, input.CookieBannerID)
+	if err != nil {
+		return nil, types.PublishCookieBannerVersionOutput{}, fmt.Errorf("cannot publish cookie banner version: %w", err)
+	}
+	return nil, types.PublishCookieBannerVersionOutput{CookieBannerVersion: types.NewCookieBannerVersion(version)}, nil
+}
+
+func (r *Resolver) ListCookieBannerVersionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieBannerVersionsInput) (*mcp.CallToolResult, types.ListCookieBannerVersionsOutput, error) {
+	r.MustAuthorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionList)
+	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
+	cursor := types.NewCursor(input.Size, input.Cursor, page.OrderBy[coredata.CookieBannerVersionOrderField]{Field: coredata.CookieBannerVersionOrderFieldCreatedAt, Direction: page.OrderDirectionDesc})
+	versions, err := r.cookieBanner.ListCookieBannerVersionsForBanner(ctx, scope, input.CookieBannerID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list cookie banner versions: %w", err))
+	}
+	p := page.NewPage(versions, cursor)
+	return nil, types.NewListCookieBannerVersionsOutput(p), nil
+}
+
+func (r *Resolver) UpsertCookieBannerTranslationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpsertCookieBannerTranslationInput) (*mcp.CallToolResult, types.UpsertCookieBannerTranslationOutput, error) {
+	r.MustAuthorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate)
+	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
+	translation, err := r.cookieBanner.UpsertCookieBannerTranslation(ctx, scope, cookiebanner.UpsertCookieBannerTranslationRequest{
+		CookieBannerID: input.CookieBannerID,
+		Language:       input.Language,
+		Translations:   json.RawMessage(input.Translations),
+	})
+	if err != nil {
+		return nil, types.UpsertCookieBannerTranslationOutput{}, fmt.Errorf("cannot upsert cookie banner translation: %w", err)
+	}
+	return nil, types.UpsertCookieBannerTranslationOutput{CookieBannerTranslation: types.NewCookieBannerTranslation(translation)}, nil
+}
+
+func (r *Resolver) ListCookieConsentRecordsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieConsentRecordsInput) (*mcp.CallToolResult, types.ListCookieConsentRecordsOutput, error) {
+	r.MustAuthorize(ctx, input.CookieBannerID, probo.ActionCookieConsentRecordList)
+	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
+	cursor := types.NewCursor(input.Size, input.Cursor, page.OrderBy[coredata.CookieConsentRecordOrderField]{Field: coredata.CookieConsentRecordOrderFieldCreatedAt, Direction: page.OrderDirectionDesc})
+
+	var action *coredata.CookieConsentAction
+	if input.Action != nil {
+		a := coredata.CookieConsentAction(*input.Action)
+		action = &a
+	}
+	filter := coredata.NewCookieConsentRecordFilter(action, input.VisitorID, input.Version)
+
+	records, err := r.cookieBanner.ListCookieConsentRecordsForBanner(ctx, scope, input.CookieBannerID, cursor, filter)
+	if err != nil {
+		panic(fmt.Errorf("cannot list cookie consent records: %w", err))
+	}
+	p := page.NewPage(records, cursor)
+	return nil, types.NewListCookieConsentRecordsOutput(p), nil
+}
+
+func (r *Resolver) GetCookieConsentRecordTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookieConsentRecordInput) (*mcp.CallToolResult, types.GetCookieConsentRecordOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionCookieConsentRecordList)
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	record, err := r.cookieBanner.GetCookieConsentRecord(ctx, scope, input.ID)
+	if err != nil {
+		return nil, types.GetCookieConsentRecordOutput{}, fmt.Errorf("cannot get cookie consent record: %w", err)
+	}
+	return nil, types.GetCookieConsentRecordOutput{CookieConsentRecord: types.NewCookieConsentRecord(record)}, nil
+}
diff --git a/pkg/server/api/mcp/v1/specification.yaml b/pkg/server/api/mcp/v1/specification.yaml
index 43c88d50c..52d1026db 100644
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -9190,6 +9190,862 @@ components:
         deleted_custom_domain:
           $ref: "#/components/schemas/CustomDomain"
 
+    CookieBanner:
+      type: object
+      required:
+        - id
+        - organization_id
+        - name
+        - origin
+        - state
+        - cookie_policy_url
+        - consent_expiry_days
+        - consent_mode
+        - show_branding
+        - default_language
+        - created_at
+        - updated_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        name:
+          type: string
+          description: Banner name
+        origin:
+          type: string
+          description: Website origin (scheme + host)
+        state:
+          type: string
+          enum: [ACTIVE, INACTIVE]
+          description: Banner state
+        privacy_policy_url:
+          type:
+            - string
+            - "null"
+          description: Privacy policy URL
+        cookie_policy_url:
+          type: string
+          description: Cookie policy URL
+        consent_expiry_days:
+          type: integer
+          description: Days until consent expires
+        consent_mode:
+          type: string
+          enum: [OPT_IN, OPT_OUT]
+          description: Consent mode
+        show_branding:
+          type: boolean
+          description: Whether to show Probo branding
+        default_language:
+          type: string
+          description: Default language code
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+        updated_at:
+          type: string
+          format: date-time
+          description: Last update timestamp
+
+    CookieCategory:
+      type: object
+      required:
+        - id
+        - organization_id
+        - cookie_banner_id
+        - name
+        - slug
+        - description
+        - kind
+        - rank
+        - created_at
+        - updated_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie category ID
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        name:
+          type: string
+          description: Category name
+        slug:
+          type: string
+          description: Category slug
+        description:
+          type: string
+          description: Category description
+        kind:
+          type: string
+          enum: [NORMAL, NECESSARY, UNCATEGORISED]
+          description: Category kind
+        rank:
+          type: integer
+          description: Display order rank
+        gcm_consent_types:
+          type: array
+          items:
+            type: string
+          description: Google Consent Mode types
+        posthog_consent:
+          type: boolean
+          description: Whether this category controls PostHog consent
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+        updated_at:
+          type: string
+          format: date-time
+          description: Last update timestamp
+
+    CookiePattern:
+      type: object
+      required:
+        - id
+        - organization_id
+        - cookie_banner_id
+        - cookie_category_id
+        - pattern
+        - match_type
+        - display_name
+        - description
+        - source
+        - created_at
+        - updated_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie pattern ID
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        cookie_category_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie category ID
+        pattern:
+          type: string
+          description: Cookie name pattern
+        match_type:
+          type: string
+          enum: [EXACT, PREFIX]
+          description: Pattern match type
+        display_name:
+          type: string
+          description: Human-friendly display name
+        max_age_seconds:
+          type:
+            - integer
+            - "null"
+          description: Cookie max age in seconds
+        description:
+          type: string
+          description: Pattern description
+        source:
+          type: string
+          enum: [SCRIPT, PRE_EXISTING]
+          description: How the pattern was discovered
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+        updated_at:
+          type: string
+          format: date-time
+          description: Last update timestamp
+
+    CookieBannerVersion:
+      type: object
+      required:
+        - id
+        - cookie_banner_id
+        - version
+        - state
+        - created_at
+        - updated_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Version ID
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        version:
+          type: integer
+          description: Version number
+        state:
+          type: string
+          enum: [DRAFT, PUBLISHED]
+          description: Version state
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+        updated_at:
+          type: string
+          format: date-time
+          description: Last update timestamp
+
+    CookieBannerTranslation:
+      type: object
+      required:
+        - id
+        - cookie_banner_id
+        - language
+        - translations
+        - created_at
+        - updated_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Translation ID
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        language:
+          type: string
+          description: Language code
+        translations:
+          type: string
+          description: Translation JSON string
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+        updated_at:
+          type: string
+          format: date-time
+          description: Last update timestamp
+
+    CookieConsentRecord:
+      type: object
+      required:
+        - id
+        - cookie_banner_id
+        - cookie_banner_version_id
+        - visitor_id
+        - consent_data
+        - action
+        - sdk_version
+        - created_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Consent record ID
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        cookie_banner_version_id:
+          $ref: "#/components/schemas/GID"
+          description: Banner version ID
+        visitor_id:
+          type: string
+          description: Visitor identifier
+        ip_address:
+          type:
+            - string
+            - "null"
+          description: Anonymized IP address
+        user_agent:
+          type:
+            - string
+            - "null"
+          description: User agent string
+        consent_data:
+          type: string
+          description: Consent data JSON
+        action:
+          type: string
+          enum: [ACCEPT_ALL, REJECT_ALL, CUSTOMIZE, GPC]
+          description: Consent action taken
+        sdk_version:
+          type: string
+          description: SDK version
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+
+    ListCookieBannersInput:
+      type: object
+      required:
+        - organization_id
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        size:
+          type: integer
+          description: Page size (default 100)
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Pagination cursor
+
+    ListCookieBannersOutput:
+      type: object
+      required:
+        - cookie_banners
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+        cookie_banners:
+          type: array
+          items:
+            $ref: "#/components/schemas/CookieBanner"
+
+    GetCookieBannerInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+
+    GetCookieBannerOutput:
+      type: object
+      required:
+        - cookie_banner
+      properties:
+        cookie_banner:
+          $ref: "#/components/schemas/CookieBanner"
+
+    AddCookieBannerInput:
+      type: object
+      required:
+        - organization_id
+        - name
+        - origin
+        - cookie_policy_url
+        - consent_expiry_days
+        - consent_mode
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        name:
+          type: string
+          description: Banner name
+        origin:
+          type: string
+          description: Website origin
+        privacy_policy_url:
+          type: string
+          description: Privacy policy URL
+        cookie_policy_url:
+          type: string
+          description: Cookie policy URL
+        consent_expiry_days:
+          type: integer
+          description: Days until consent expires
+        consent_mode:
+          type: string
+          enum: [OPT_IN, OPT_OUT]
+          description: Consent mode
+
+    AddCookieBannerOutput:
+      type: object
+      required:
+        - cookie_banner
+      properties:
+        cookie_banner:
+          $ref: "#/components/schemas/CookieBanner"
+
+    UpdateCookieBannerInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        name:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        privacy_policy_url:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        cookie_policy_url:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        consent_expiry_days:
+          type:
+            - integer
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        consent_mode:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        default_language:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+
+    UpdateCookieBannerOutput:
+      type: object
+      required:
+        - cookie_banner
+      properties:
+        cookie_banner:
+          $ref: "#/components/schemas/CookieBanner"
+
+    DeleteCookieBannerInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+
+    DeleteCookieBannerOutput:
+      type: object
+      required:
+        - deleted_id
+      properties:
+        deleted_id:
+          $ref: "#/components/schemas/GID"
+
+    ActivateCookieBannerInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+
+    ActivateCookieBannerOutput:
+      type: object
+      required:
+        - cookie_banner
+      properties:
+        cookie_banner:
+          $ref: "#/components/schemas/CookieBanner"
+
+    DeactivateCookieBannerInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+
+    DeactivateCookieBannerOutput:
+      type: object
+      required:
+        - cookie_banner
+      properties:
+        cookie_banner:
+          $ref: "#/components/schemas/CookieBanner"
+
+    ListCookieCategoriesInput:
+      type: object
+      required:
+        - cookie_banner_id
+      properties:
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+          description: Cookie banner ID
+        size:
+          type: integer
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+
+    ListCookieCategoriesOutput:
+      type: object
+      required:
+        - cookie_categories
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+        cookie_categories:
+          type: array
+          items:
+            $ref: "#/components/schemas/CookieCategory"
+
+    GetCookieCategoryInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+
+    GetCookieCategoryOutput:
+      type: object
+      required:
+        - cookie_category
+      properties:
+        cookie_category:
+          $ref: "#/components/schemas/CookieCategory"
+
+    AddCookieCategoryInput:
+      type: object
+      required:
+        - cookie_banner_id
+        - name
+        - slug
+        - description
+        - rank
+      properties:
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+        name:
+          type: string
+        slug:
+          type: string
+        description:
+          type: string
+        rank:
+          type: integer
+
+    AddCookieCategoryOutput:
+      type: object
+      required:
+        - cookie_category
+      properties:
+        cookie_category:
+          $ref: "#/components/schemas/CookieCategory"
+
+    UpdateCookieCategoryInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+        name:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        slug:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        description:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+
+    UpdateCookieCategoryOutput:
+      type: object
+      required:
+        - cookie_category
+      properties:
+        cookie_category:
+          $ref: "#/components/schemas/CookieCategory"
+
+    DeleteCookieCategoryInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+
+    DeleteCookieCategoryOutput:
+      type: object
+      required:
+        - deleted_id
+      properties:
+        deleted_id:
+          $ref: "#/components/schemas/GID"
+
+    ReorderCookieCategoryInput:
+      type: object
+      required:
+        - id
+        - rank
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+        rank:
+          type: integer
+
+    ReorderCookieCategoryOutput:
+      type: object
+      required:
+        - cookie_category
+      properties:
+        cookie_category:
+          $ref: "#/components/schemas/CookieCategory"
+
+    ListCookiePatternsInput:
+      type: object
+      required:
+        - cookie_category_id
+      properties:
+        cookie_category_id:
+          $ref: "#/components/schemas/GID"
+        size:
+          type: integer
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+
+    ListCookiePatternsOutput:
+      type: object
+      required:
+        - cookie_patterns
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+        cookie_patterns:
+          type: array
+          items:
+            $ref: "#/components/schemas/CookiePattern"
+
+    GetCookiePatternInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+
+    GetCookiePatternOutput:
+      type: object
+      required:
+        - cookie_pattern
+      properties:
+        cookie_pattern:
+          $ref: "#/components/schemas/CookiePattern"
+
+    AddCookiePatternInput:
+      type: object
+      required:
+        - cookie_category_id
+        - pattern
+        - match_type
+        - display_name
+        - description
+      properties:
+        cookie_category_id:
+          $ref: "#/components/schemas/GID"
+        pattern:
+          type: string
+        match_type:
+          type: string
+          enum: [EXACT, PREFIX]
+        display_name:
+          type: string
+        max_age_seconds:
+          type: integer
+        description:
+          type: string
+
+    AddCookiePatternOutput:
+      type: object
+      required:
+        - cookie_pattern
+      properties:
+        cookie_pattern:
+          $ref: "#/components/schemas/CookiePattern"
+
+    UpdateCookiePatternInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+        display_name:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        max_age_seconds:
+          type:
+            - integer
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+        description:
+          type:
+            - string
+            - "null"
+          go.probo.inc/mcpgen/omittable: true
+
+    UpdateCookiePatternOutput:
+      type: object
+      required:
+        - cookie_pattern
+      properties:
+        cookie_pattern:
+          $ref: "#/components/schemas/CookiePattern"
+
+    DeleteCookiePatternInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+
+    DeleteCookiePatternOutput:
+      type: object
+      required:
+        - deleted_id
+      properties:
+        deleted_id:
+          $ref: "#/components/schemas/GID"
+
+    MoveCookiePatternToCategoryInput:
+      type: object
+      required:
+        - cookie_pattern_id
+        - target_cookie_category_id
+      properties:
+        cookie_pattern_id:
+          $ref: "#/components/schemas/GID"
+        target_cookie_category_id:
+          $ref: "#/components/schemas/GID"
+
+    MoveCookiePatternToCategoryOutput:
+      type: object
+      required:
+        - cookie_pattern
+      properties:
+        cookie_pattern:
+          $ref: "#/components/schemas/CookiePattern"
+
+    PublishCookieBannerVersionInput:
+      type: object
+      required:
+        - cookie_banner_id
+      properties:
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+
+    PublishCookieBannerVersionOutput:
+      type: object
+      required:
+        - cookie_banner_version
+      properties:
+        cookie_banner_version:
+          $ref: "#/components/schemas/CookieBannerVersion"
+
+    ListCookieBannerVersionsInput:
+      type: object
+      required:
+        - cookie_banner_id
+      properties:
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+        size:
+          type: integer
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+
+    ListCookieBannerVersionsOutput:
+      type: object
+      required:
+        - cookie_banner_versions
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+        cookie_banner_versions:
+          type: array
+          items:
+            $ref: "#/components/schemas/CookieBannerVersion"
+
+    UpsertCookieBannerTranslationInput:
+      type: object
+      required:
+        - cookie_banner_id
+        - language
+        - translations
+      properties:
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+        language:
+          type: string
+        translations:
+          type: string
+          description: Translation JSON string
+
+    UpsertCookieBannerTranslationOutput:
+      type: object
+      required:
+        - cookie_banner_translation
+      properties:
+        cookie_banner_translation:
+          $ref: "#/components/schemas/CookieBannerTranslation"
+
+    ListCookieConsentRecordsInput:
+      type: object
+      required:
+        - cookie_banner_id
+      properties:
+        cookie_banner_id:
+          $ref: "#/components/schemas/GID"
+        size:
+          type: integer
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+        action:
+          type: string
+          enum: [ACCEPT_ALL, REJECT_ALL, CUSTOMIZE, GPC]
+          description: Filter by consent action
+        visitor_id:
+          type: string
+          description: Filter by visitor ID
+        version:
+          type: integer
+          description: Filter by banner version number
+
+    ListCookieConsentRecordsOutput:
+      type: object
+      required:
+        - cookie_consent_records
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+        cookie_consent_records:
+          type: array
+          items:
+            $ref: "#/components/schemas/CookieConsentRecord"
+
+    GetCookieConsentRecordInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+
+    GetCookieConsentRecordOutput:
+      type: object
+      required:
+        - cookie_consent_record
+      properties:
+        cookie_consent_record:
+          $ref: "#/components/schemas/CookieConsentRecord"
+
 tools:
   - name: listOrganizations
     description: List all organizations the user has access to
@@ -10903,3 +11759,207 @@ tools:
       $ref: "#/components/schemas/DeleteCustomDomainInput"
     outputSchema:
       $ref: "#/components/schemas/DeleteCustomDomainOutput"
+  - name: listCookieBanners
+    description: List all cookie banners for the organization
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListCookieBannersInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListCookieBannersOutput"
+  - name: getCookieBanner
+    description: Get a cookie banner by ID
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/GetCookieBannerInput"
+    outputSchema:
+      $ref: "#/components/schemas/GetCookieBannerOutput"
+  - name: addCookieBanner
+    description: Create a new cookie banner for an organization
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/AddCookieBannerInput"
+    outputSchema:
+      $ref: "#/components/schemas/AddCookieBannerOutput"
+  - name: updateCookieBanner
+    description: Update an existing cookie banner
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/UpdateCookieBannerInput"
+    outputSchema:
+      $ref: "#/components/schemas/UpdateCookieBannerOutput"
+  - name: deleteCookieBanner
+    description: Delete a cookie banner
+    hints:
+      readonly: false
+      destructive: true
+    inputSchema:
+      $ref: "#/components/schemas/DeleteCookieBannerInput"
+    outputSchema:
+      $ref: "#/components/schemas/DeleteCookieBannerOutput"
+  - name: activateCookieBanner
+    description: Activate a cookie banner
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/ActivateCookieBannerInput"
+    outputSchema:
+      $ref: "#/components/schemas/ActivateCookieBannerOutput"
+  - name: deactivateCookieBanner
+    description: Deactivate a cookie banner
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/DeactivateCookieBannerInput"
+    outputSchema:
+      $ref: "#/components/schemas/DeactivateCookieBannerOutput"
+  - name: listCookieCategories
+    description: List all cookie categories for a banner
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListCookieCategoriesInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListCookieCategoriesOutput"
+  - name: getCookieCategory
+    description: Get a cookie category by ID
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/GetCookieCategoryInput"
+    outputSchema:
+      $ref: "#/components/schemas/GetCookieCategoryOutput"
+  - name: addCookieCategory
+    description: Create a new cookie category for a banner
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/AddCookieCategoryInput"
+    outputSchema:
+      $ref: "#/components/schemas/AddCookieCategoryOutput"
+  - name: updateCookieCategory
+    description: Update an existing cookie category
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/UpdateCookieCategoryInput"
+    outputSchema:
+      $ref: "#/components/schemas/UpdateCookieCategoryOutput"
+  - name: deleteCookieCategory
+    description: Delete a cookie category
+    hints:
+      readonly: false
+      destructive: true
+    inputSchema:
+      $ref: "#/components/schemas/DeleteCookieCategoryInput"
+    outputSchema:
+      $ref: "#/components/schemas/DeleteCookieCategoryOutput"
+  - name: reorderCookieCategory
+    description: Change the display order rank of a cookie category
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/ReorderCookieCategoryInput"
+    outputSchema:
+      $ref: "#/components/schemas/ReorderCookieCategoryOutput"
+  - name: listCookiePatterns
+    description: List all cookie patterns for a category
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListCookiePatternsInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListCookiePatternsOutput"
+  - name: getCookiePattern
+    description: Get a cookie pattern by ID
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/GetCookiePatternInput"
+    outputSchema:
+      $ref: "#/components/schemas/GetCookiePatternOutput"
+  - name: addCookiePattern
+    description: Create a new cookie pattern for a category
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/AddCookiePatternInput"
+    outputSchema:
+      $ref: "#/components/schemas/AddCookiePatternOutput"
+  - name: updateCookiePattern
+    description: Update an existing cookie pattern
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/UpdateCookiePatternInput"
+    outputSchema:
+      $ref: "#/components/schemas/UpdateCookiePatternOutput"
+  - name: deleteCookiePattern
+    description: Delete a cookie pattern
+    hints:
+      readonly: false
+      destructive: true
+    inputSchema:
+      $ref: "#/components/schemas/DeleteCookiePatternInput"
+    outputSchema:
+      $ref: "#/components/schemas/DeleteCookiePatternOutput"
+  - name: moveCookiePatternToCategory
+    description: Move a cookie pattern to a different category
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/MoveCookiePatternToCategoryInput"
+    outputSchema:
+      $ref: "#/components/schemas/MoveCookiePatternToCategoryOutput"
+  - name: publishCookieBannerVersion
+    description: Publish the current draft version of a cookie banner
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/PublishCookieBannerVersionInput"
+    outputSchema:
+      $ref: "#/components/schemas/PublishCookieBannerVersionOutput"
+  - name: listCookieBannerVersions
+    description: List all versions for a cookie banner
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListCookieBannerVersionsInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListCookieBannerVersionsOutput"
+  - name: upsertCookieBannerTranslation
+    description: Insert or update a cookie banner translation for a language
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/UpsertCookieBannerTranslationInput"
+    outputSchema:
+      $ref: "#/components/schemas/UpsertCookieBannerTranslationOutput"
+  - name: listCookieConsentRecords
+    description: List consent records for a cookie banner
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListCookieConsentRecordsInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListCookieConsentRecordsOutput"
+  - name: getCookieConsentRecord
+    description: Get a consent record by ID
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/GetCookieConsentRecordInput"
+    outputSchema:
+      $ref: "#/components/schemas/GetCookieConsentRecordOutput"
diff --git a/pkg/server/api/mcp/v1/types/cookie_banner.go b/pkg/server/api/mcp/v1/types/cookie_banner.go
new file mode 100644
index 000000000..295f4ab8d
--- /dev/null
+++ b/pkg/server/api/mcp/v1/types/cookie_banner.go
@@ -0,0 +1,67 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewCookieBanner(b *coredata.CookieBanner) *CookieBanner {
+	return &CookieBanner{
+		ID:                b.ID,
+		OrganizationID:    b.OrganizationID,
+		Name:              b.Name,
+		Origin:            b.Origin,
+		State:             CookieBannerState(b.State),
+		PrivacyPolicyURL:  b.PrivacyPolicyURL,
+		CookiePolicyURL:   b.CookiePolicyURL,
+		ConsentExpiryDays: b.ConsentExpiryDays,
+		ConsentMode:       CookieBannerConsentMode(b.ConsentMode),
+		ShowBranding:      b.ShowBranding,
+		DefaultLanguage:   b.DefaultLanguage,
+		CreatedAt:         b.CreatedAt,
+		UpdatedAt:         b.UpdatedAt,
+	}
+}
+
+func NewListCookieBannersOutput(p *page.Page[*coredata.CookieBanner, coredata.CookieBannerOrderField]) ListCookieBannersOutput {
+	banners := make([]*CookieBanner, 0, len(p.Data))
+	for _, b := range p.Data {
+		banners = append(banners, NewCookieBanner(b))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(p.Data) > 0 {
+		cursorKey := p.Data[len(p.Data)-1].CursorKey(p.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListCookieBannersOutput{
+		NextCursor:    nextCursor,
+		CookieBanners: banners,
+	}
+}
+
+func NewCookieBannerTranslation(t *coredata.CookieBannerTranslation) *CookieBannerTranslation {
+	return &CookieBannerTranslation{
+		ID:             t.ID,
+		CookieBannerID: t.CookieBannerID,
+		Language:       t.Language,
+		Translations:   string(t.Translations),
+		CreatedAt:      t.CreatedAt,
+		UpdatedAt:      t.UpdatedAt,
+	}
+}
diff --git a/pkg/server/api/mcp/v1/types/cookie_banner_version.go b/pkg/server/api/mcp/v1/types/cookie_banner_version.go
new file mode 100644
index 000000000..c7f953652
--- /dev/null
+++ b/pkg/server/api/mcp/v1/types/cookie_banner_version.go
@@ -0,0 +1,49 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewCookieBannerVersion(v *coredata.CookieBannerVersion) *CookieBannerVersion {
+	return &CookieBannerVersion{
+		ID:             v.ID,
+		CookieBannerID: v.CookieBannerID,
+		Version:        v.Version,
+		State:          CookieBannerVersionState(v.State),
+		CreatedAt:      v.CreatedAt,
+		UpdatedAt:      v.UpdatedAt,
+	}
+}
+
+func NewListCookieBannerVersionsOutput(p *page.Page[*coredata.CookieBannerVersion, coredata.CookieBannerVersionOrderField]) ListCookieBannerVersionsOutput {
+	versions := make([]*CookieBannerVersion, 0, len(p.Data))
+	for _, v := range p.Data {
+		versions = append(versions, NewCookieBannerVersion(v))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(p.Data) > 0 {
+		cursorKey := p.Data[len(p.Data)-1].CursorKey(p.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListCookieBannerVersionsOutput{
+		NextCursor:           nextCursor,
+		CookieBannerVersions: versions,
+	}
+}
diff --git a/pkg/server/api/mcp/v1/types/cookie_category.go b/pkg/server/api/mcp/v1/types/cookie_category.go
new file mode 100644
index 000000000..4ae290d5e
--- /dev/null
+++ b/pkg/server/api/mcp/v1/types/cookie_category.go
@@ -0,0 +1,61 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewCookieCategory(c *coredata.CookieCategory) *CookieCategory {
+	var posthogConsent *bool
+	if c.PostHogConsent {
+		v := true
+		posthogConsent = &v
+	}
+
+	return &CookieCategory{
+		ID:              c.ID,
+		OrganizationID:  c.OrganizationID,
+		CookieBannerID:  c.CookieBannerID,
+		Name:            c.Name,
+		Slug:            c.Slug,
+		Description:     c.Description,
+		Kind:            CookieCategoryKind(c.Kind),
+		Rank:            c.Rank,
+		GcmConsentTypes: c.GCMConsentTypes,
+		PosthogConsent:  posthogConsent,
+		CreatedAt:       c.CreatedAt,
+		UpdatedAt:       c.UpdatedAt,
+	}
+}
+
+func NewListCookieCategoriesOutput(p *page.Page[*coredata.CookieCategory, coredata.CookieCategoryOrderField]) ListCookieCategoriesOutput {
+	categories := make([]*CookieCategory, 0, len(p.Data))
+	for _, c := range p.Data {
+		categories = append(categories, NewCookieCategory(c))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(p.Data) > 0 {
+		cursorKey := p.Data[len(p.Data)-1].CursorKey(p.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListCookieCategoriesOutput{
+		NextCursor:       nextCursor,
+		CookieCategories: categories,
+	}
+}
diff --git a/pkg/server/api/mcp/v1/types/cookie_consent_record.go b/pkg/server/api/mcp/v1/types/cookie_consent_record.go
new file mode 100644
index 000000000..e914fdcb9
--- /dev/null
+++ b/pkg/server/api/mcp/v1/types/cookie_consent_record.go
@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewCookieConsentRecord(r *coredata.CookieConsentRecord) *CookieConsentRecord {
+	var consentData string
+	if r.ConsentData != nil {
+		consentData = string(r.ConsentData)
+	}
+
+	return &CookieConsentRecord{
+		ID:                    r.ID,
+		CookieBannerID:        r.CookieBannerID,
+		CookieBannerVersionID: r.CookieBannerVersionID,
+		VisitorID:             r.VisitorID,
+		IPAddress:             r.IPAddress,
+		UserAgent:             r.UserAgent,
+		ConsentData:           consentData,
+		Action:                CookieConsentRecordAction(r.Action),
+		SdkVersion:            r.SdkVersion,
+		CreatedAt:             r.CreatedAt,
+	}
+}
+
+func NewListCookieConsentRecordsOutput(p *page.Page[*coredata.CookieConsentRecord, coredata.CookieConsentRecordOrderField]) ListCookieConsentRecordsOutput {
+	records := make([]*CookieConsentRecord, 0, len(p.Data))
+	for _, r := range p.Data {
+		records = append(records, NewCookieConsentRecord(r))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(p.Data) > 0 {
+		cursorKey := p.Data[len(p.Data)-1].CursorKey(p.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListCookieConsentRecordsOutput{
+		NextCursor:           nextCursor,
+		CookieConsentRecords: records,
+	}
+}
diff --git a/pkg/server/api/mcp/v1/types/cookie_pattern.go b/pkg/server/api/mcp/v1/types/cookie_pattern.go
new file mode 100644
index 000000000..727709654
--- /dev/null
+++ b/pkg/server/api/mcp/v1/types/cookie_pattern.go
@@ -0,0 +1,55 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewCookiePattern(p *coredata.CookiePattern) *CookiePattern {
+	return &CookiePattern{
+		ID:               p.ID,
+		OrganizationID:   p.OrganizationID,
+		CookieBannerID:   p.CookieBannerID,
+		CookieCategoryID: p.CookieCategoryID,
+		Pattern:          p.Pattern,
+		MatchType:        CookiePatternMatchType(p.MatchType),
+		DisplayName:      p.DisplayName,
+		MaxAgeSeconds:    p.MaxAgeSeconds,
+		Description:      p.Description,
+		Source:           CookiePatternSource(p.Source),
+		CreatedAt:        p.CreatedAt,
+		UpdatedAt:        p.UpdatedAt,
+	}
+}
+
+func NewListCookiePatternsOutput(pg *page.Page[*coredata.CookiePattern, coredata.CookiePatternOrderField]) ListCookiePatternsOutput {
+	patterns := make([]*CookiePattern, 0, len(pg.Data))
+	for _, p := range pg.Data {
+		patterns = append(patterns, NewCookiePattern(p))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(pg.Data) > 0 {
+		cursorKey := pg.Data[len(pg.Data)-1].CursorKey(pg.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListCookiePatternsOutput{
+		NextCursor:     nextCursor,
+		CookiePatterns: patterns,
+	}
+}
diff --git a/pkg/server/api/mcp/v1/v1_handler.go b/pkg/server/api/mcp/v1/v1_handler.go
index 2d2678d08..fe96e9ff9 100644
--- a/pkg/server/api/mcp/v1/v1_handler.go
+++ b/pkg/server/api/mcp/v1/v1_handler.go
@@ -23,6 +23,7 @@ import (
 	"go.gearno.de/kit/log"
 	mcpgenmcp "go.probo.inc/mcpgen/mcp"
 	"go.probo.inc/probo/pkg/accessreview"
+	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/probo"
@@ -35,7 +36,7 @@ func (r *Resolver) ProboService(ctx context.Context, objectID gid.GID) *probo.Te
 	return r.proboSvc.WithTenant(objectID.TenantID())
 }
 
-func NewMux(logger *log.Logger, proboSvc *probo.Service, iamSvc *iam.Service, accessReviewSvc *accessreview.Service, tokenSecret string) *chi.Mux {
+func NewMux(logger *log.Logger, proboSvc *probo.Service, iamSvc *iam.Service, accessReviewSvc *accessreview.Service, cookieBannerSvc *cookiebanner.Service, tokenSecret string) *chi.Mux {
 	logger = logger.Named("mcp.v1")
 
 	logger.Info("initializing MCP server")
@@ -45,6 +46,7 @@ func NewMux(logger *log.Logger, proboSvc *probo.Service, iamSvc *iam.Service, ac
 		proboSvc:     proboSvc,
 		iamSvc:       iamSvc,
 		accessReview: accessReviewSvc,
+		cookieBanner: cookieBannerSvc,
 		logger:       logger,
 	}