Privacy

What a scan processes

When you start a check, the service transiently processes the MCP endpoint you entered and, when supplied, the bearer access token. The endpoint is contacted only for the bounded MCP discovery and tools/list requests needed to assemble the report. The service does not call an MCP tool or request MCP resources.

The bearer token is sent in the Authorization header only to the exact endpoint being checked. It is not written to the quota store, returned in the report, or intentionally logged. On the hosted service, exact token bytes are redacted from upstream response headers and bodies before relay; the browser discards the catalog if decoded JSON keys or values still reproduce the token. Cloudflare, your browser, and the MCP provider necessarily process network traffic while the request is in flight.

What is retained

The report and returned tool catalog remain in your browser and are not saved by this product. The public hosted service keeps pseudonymous abuse-control data: a signed random browser identifier and daily keyed hashes representing the browser, network, and target host. Those keyed quota records roll off after the following day. Separate daily usage summaries contain no identifiers and are retained for up to 90 days: accepted scan totals, the number of scanning browsers, and how many browsers scanned each number of times. These summaries cannot identify a browser or link its activity across days. They are available only through the operator's authenticated usage report. These records cannot be used by the product to recover the raw endpoint or access token. A locally run copy uses its own operator-controlled aggregate usage store instead of the hosted quota system.

On the public hosted service, the signed browser cookie is strictly necessary to enforce the daily free limit. You can delete it through your browser settings; doing so does not erase already aggregated daily counters.

Cloudflare services

The public hosted service uses Cloudflare Workers, static asset hosting, Durable Objects, and Turnstile for delivery, quota enforcement, and abuse prevention. Cloudflare may process connection and security data under its own terms and privacy commitments. A locally run copy does not use those hosted services unless its operator configures them. No third-party advertising tracker is included in the scanner.

Your choices and questions

Do not paste passwords, refresh tokens, API keys, client secrets, session cookies, or a bearer token that was not issued for the endpoint being checked. If you have a privacy question or request for the operator, email agenticdefender@gmail.com.