# Cookie Analyzer — MCP tool `findutils:cookie_analyzer`

Analyze Set-Cookie header strings and return a per-cookie list of security issues, an overall 0-100 score, and recommendations. Checks Secure, HttpOnly, SameSite, expiry, path scope, sensitive names, and the __Secure-/__Host- prefix rules. One cookie per line; the "Set-Cookie:" prefix is optional.

- Category: network
- MCP server: https://mcp.findutils.com/ (Streamable HTTP, no API keys, 120 req/min per IP)
- REST endpoint: POST https://api.findutils.com/api/tools/cookie-analyzer/execute (no API keys, 60 req/min per IP)
- Reference page: https://findutils.com/mcp/cookie-analyzer/
- Same tool on the other surface: https://findutils.com/api/cookie-analyzer/

## Connect

```bash
claude mcp add findutils --transport http https://mcp.findutils.com/
```

Claude Desktop (`claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "findutils": {
      "url": "https://mcp.findutils.com/"
    }
  }
}
```

## Call the tool (verified example)

```bash
curl -X POST https://mcp.findutils.com/ \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "cookie_analyzer",
      "arguments": {
        "cookies": "sessionid=abc; Secure; HttpOnly; SameSite=Lax"
      }
    }
  }'
```

## Input schema

| Argument | Type | Required | Description |
|---|---|---|---|
| `cookies` | string | yes | One or more cookie strings, one per line (e.g. "sessionid=abc; Secure; HttpOnly; SameSite=Lax"). A leading "Set-Cookie:" is stripped. |

Example arguments (verified):

```json
{
  "cookies": "sessionid=abc; Secure; HttpOnly; SameSite=Lax"
}
```

## Also a REST endpoint

```bash
curl -X POST https://api.findutils.com/api/tools/cookie-analyzer/execute \
  -H "Content-Type: application/json" \
  -d '{
    "cookies": "sessionid=abc; Secure; HttpOnly; SameSite=Lax"
  }'

# Parameter schema
curl https://api.findutils.com/api/tools/cookie-analyzer
```

Full REST reference: https://findutils.com/api/cookie-analyzer/ · OpenAPI 3.1 spec: https://findutils.com/api/openapi.json

---
Full catalog: POST https://mcp.findutils.com/ with method `tools/list` · https://findutils.com/mcp/ · https://findutils.com/llms.txt