The short version
The server runs on your machine, reads files you point it at, and makes no network requests. This website is static — no analytics, no cookies, no third-party scripts.
This website
The site is a static page built with Astro and Blume. It sets no tracking cookies, runs no analytics, and loads no third-party scripts. Standard hosting logs (IP address, requested page, timestamp) may be kept by the hosting provider for operational purposes.
The server
secure-mcp is a local subprocess of your agent client. It communicates over stdio only and in v1 performs no network calls. Logs and diagnostics go to stderr only; stdout is reserved for MCP protocol messages.
Code you review
Files under the requested project root are read within documented size, count, and depth caps. Project code is never executed, never modified, and never transmitted anywhere. Secret-like evidence is redacted before findings are returned, and review output should still be handled carefully — it describes weaknesses in your own codebase.
Changes
If this policy changes, the updated version will appear on this page. Because the product ships no telemetry, there is nothing to opt out of — and nothing about your usage is ever collected.
Contact
Questions about this policy? Use the project support page to find the appropriate public or private GitHub channel.