# The consent tools

Use the `consent_*` MCP tools to configure Consent and read its records for a product; each call names it in `product_id`. The app uses the same underlying operations. Each tool also has an authenticated REST route.

For exact input and output schemas, use the [MCP tool catalog](/reference/mcp-tools) or [Consent REST reference](/reference/openapi/consent). The tables below show the access level each operation requires.

Consent has no `@lepsto/sdk` subpath. Install the banner with its snippet, use MCP or authenticated REST for management, and let the banner call the public runtime routes.

## Installation

| Tool | Level | Action |
|---|---|---|
| `consent_embed_get` | read | Get the script snippet, product id and public edge base URL |
| `consent_dashboard_embed_snippet_get` | read | Get the install-card snippet and banner URL |

Both return the same `script_tag`, including its installation comment. `consent_embed_get` returns `product_id` and uses `public_edge_url` for the base URL. The dashboard variant omits `product_id` and uses `public_edge_url` for the full `banner.js` URL. See [Add a cookie consent banner](/privacy/cookie-consent).

## Providers and cookies

| Tool | Level | Action |
|---|---|---|
| `consent_providers_list` | read | List providers and their cookies |
| `consent_providers_create` | write | Create a provider declaration |
| `consent_providers_update` | write | Update a provider; supplied `cookies` replace its entire cookie set |
| `consent_providers_delete` | admin | Delete a provider |

See [Declare your providers and cookies](/privacy/providers-and-cookies) for host and cookie field requirements. Individual cookie operations are available through REST.

## Configuration

| Tool | Level | Action |
|---|---|---|
| `consent_config_theme_upsert` | write | Merge theme settings into the saved theme |
| `consent_config_customization_upsert` | write | Merge images and placement settings |
| `consent_config_floating_icon_upsert` | write | Configure the icon or a custom preferences trigger |
| `consent_config_cookie_domain_upsert` | admin | Set or clear the consent cookie domain override |
| `consent_dashboard_config_get` | read | Read the resolved theme, customization and floating-icon configuration |

See [Configure the banner](/privacy/configuration) for valid examples and cache timing.

## Reporting

| Tool | Level | Action |
|---|---|---|
| `consent_stats_get` | read | Read choice percentages and category breakdowns over a window |
| `consent_dashboard_stats_get` | read | Read the dashboard summary |
| `consent_dashboard_decisions_list` | read | List recent decisions with their computed labels |
| `consent_records_export` | admin | Export inline CSV with a download URL if the result is truncated |

See [Consent records](/privacy/consent-records) for window syntax, CSV columns and export limits.

## Access levels

The platform checks each tool's required level before calling Consent. Viewer access permits `read`; Member permits `read` and `write`; Admin and Owner also permit `admin`. Agent credentials need the corresponding product scope.

Provider deletion, record export and cookie domain changes require Admin. Export remains an administrative operation even though it only reads. Changing the cookie domain also affects where existing visitor choices can be read.

## What is not a tool

The visitor's browser uses these public routes under `https://public.lepsto.com/<YOUR_PRODUCT_ID>/consent`. Replace `<YOUR_PRODUCT_ID>` with your product id.

| Operation | Caller and purpose |
|---|---|
| `GET /banner.js` | Script tag loading the runtime |
| `GET /declaration` | Link or iframe displaying the Cookie Declaration |
| `GET /config` | Runtime reading banner configuration |
| `POST /decision` | Runtime recording the visitor's choice |

These routes need no credentials and are rate limited per IP. For authenticated configuration reads, use `consent_dashboard_config_get`. Collect visitor decisions through the banner.

## Errors

Failed MCP calls return error text with an error flag. The message matches the REST error message, but does not include an HTTP status code. Invalid input, such as an inverted export date range, produces a failed call rather than an empty result.

## Next steps

- [Consent REST reference](/reference/openapi/consent): inspect the route schemas.
- [Lepsto Consent](/privacy): understand how configuration and decisions fit together.