Privacy Policy

What this policy covers

This policy applies to personal data we process when you visit mcprush.com, create an account, buy or install a listing, publish one, call a server through our gateway or through a server we host for its publisher, use our command-line tool, API or catalogue MCP server, contact us, apply for a job, or subscribe to our emails. It also covers the authors of software we list from public sources (section 08).

It does not cover:

• what a publisher’s software does with the data your agent sends it — that is governed by the publisher’s own terms and notice;
• websites, repositories and packages that listings link to;
• Stripe’s processing as an independent controller, which is governed by the Stripe Privacy Policy;
• what your own organisation does with data, where you use mcprush for work.

Read it together with the terms of service. If you give us personal data about someone else — a teammate you invite, a person named in a ticket, personal data you send through a tool — you are responsible for having the right to do so.

What we collect, and where it comes from

You can browse the catalogue without an account. To buy, install through the gateway, publish or open a ticket you need one, and some fields are required to provide that.

We do not ask for special categories of data, such as health, religion or biometric data. Please do not put them — or anyone else’s personal data you are not entitled to share — into reviews, tickets, listings or tool calls. We do not buy personal data from data brokers.

What passes through a tool call, and what is written down

A remote server runs on its publisher’s infrastructure — or on ours, if the publisher uses our hosting — and your client reaches it through our gateway. The gateway checks your key, routes the call, returns the answer and meters it. The whole call, including the tool name, every argument and the response, passes through our systems in transit, because a call cannot be routed without it. We do not store the arguments or the response.

What we keep is one row per call. Simplified, it looks like this:

{
  "at":              "2026-09-28T14:20:06.481Z",
  "account":         "acct_…",
  "listing":         "<listing>",
  "install":         "ins_…",
  "key":             "key_…",
  "client":          "claude-code",
  "method":          "tools/call",
  "tool":            "<tool>",
  "status":          200,
  "upstream_status": 200,
  "ms":              640,
  "bytes_up":        412,
  "bytes_down":      41903,
  "billable":        true,
  "error":           null
}

That is the row. There is no field for the arguments you sent or for the content that came back — only their sizes. The same limit applies when you attach diagnostics to a ticket: call metadata only.

Separately from this row, the web server in front of the gateway logs the IP address, user agent and address of each request, as it does for every page (section 10). It does not log request or response bodies.

The publisher receives your data

The server you call receives the arguments, because that is what a tool call is. It also receives an install identifier — not your account ID or email address — and any configuration values you set for it, such as your key to another service. What that server does with them is governed by its publisher’s terms and notice, not by this one. Read a listing’s declared tools, and what each tool says it reaches, before pointing it at sensitive data. To the extent permitted by law, we are not responsible for what a publisher’s software does with data your agent sends it.

Servers we host for a publisher

If a listing uses our hosting, the publisher’s code runs on Amazon Web Services in the United States (us-east-1), on the publisher’s behalf. The configuration values you set for it are stored as encrypted parameters in AWS and passed only to that server. Whatever the publisher’s code writes to its own log — which can include arguments, if the code prints them — is kept in AWS for 7 days and can be read by us to troubleshoot. What the code does is the publisher’s responsibility.

Refused calls

A call the gateway refuses — a write tool on a read-only key, a tool nobody on your account has accepted yet, a paused install — is written to your call log with the tool and the reason. The gateway sees the call and the answer, not what the publisher’s code connects to inside its own process (terms 6.6).

A server on your own machine

A local server never touches the gateway. We record that you installed it, and that you paid for it if it was not free. Its calls, its arguments and its results stay on your computer.

Nothing from a tool call is sold, used for advertising, or used to train AI models.

Related: what the scan checks · what a key can reach

Why we use it, and on what legal basis

If the GDPR, the UK GDPR or Swiss data protection law applies to you, these are the bases we rely on. Where we rely on legitimate interests, you can object (section 12) and ask how we balanced them against yours.

Service providers and other recipients

These providers run parts of mcprush for us. Most of them process personal data on our behalf, as our processors. Stripe for its own purposes, Google and GitHub when you sign in with them, and search engines act as independent controllers for their own processing.

Other recipients

• Publishers — what section 06 describes, and whatever your agent sends their servers (section 03); and, if you send a notice about their listing (terms section 16), the notice itself, including the name and contact details you give, as the DMCA and the Digital Services Act require.
• The person who referred you — the state of the referral, the month you joined and the settled amount their share is computed from, with your address masked; never what you installed or anything you wrote. Ask and we remove the referral tag: the reward stops and nothing else changes.
• Your team — owners and admins of an organisation account see its members, seats, installs, spending and audit trail.
• The public — reviews, publisher profiles and listings are public. Search engines and others may index and copy them, and we cannot recall copies made by third parties.
• Professional advisers, auditors and insurers, under a duty of confidentiality.
• Authorities, courts and others where the law requires it, or where reasonably necessary to protect rights, safety or property, to prevent fraud or abuse, or to enforce our terms. Where we lawfully can and it is appropriate, we tell the person concerned.
• A buyer or successor of all or part of our business, in a merger, acquisition, financing or sale of assets, bound by this policy for data we held before the transfer.

We do not sell personal data, do not give it to advertisers or data brokers, and do not let our providers use it for their own advertising. Support tickets are handled inside mcprush; no helpdesk vendor reads them. There is no session recording, no heatmap and no advertising network.

What a publisher can see about you

Enough to run a listing and to support it:

• Figures for their own listings: views, readers, installs, active installs, calls, failures, latency, revenue and a breakdown by client.
• For each sale and each payment dispute on their listing: the amount, the date and a buyer label — your organisation name, or your name if there is no organisation, or your email address if you have given neither. Set an organisation or a name on your account if you would rather that showed.
• If you open a ticket about their listing: your name — or, if you have not set one, the part of your email address before the @ — your organisation and what you wrote. Diagnostics — version, clients, recent call counts and failure codes — go only if you tick the box.
• If you publish a review: what the review shows publicly.
• What your agent sends their server, as section 03 describes.

What you can see about a publisher

The asymmetry is deliberate. A publisher asks you to run their code against your data, so the burden of being legible is theirs. All of this is public on every listing and profile, without an account:

• The publisher's name, whether they are verified, and what verification checked.
• The site they publish from and the year they started.
• Every listing they own, with installs, rating, success rate and p95 over thirty days.
• Every release, its date, its notes, and which tools it added, removed or widened (terms 6.3).
• The scan grade and the report behind it — for package and repository sources, re-run for each new version (terms 6.5).
• The declared tool surface and the reach each tool declares.
• Their median first reply on tickets, so you know what support you are buying.

A publisher’s profile can include personal data the publisher chose to publish, such as a name or a website. Not public: which individual at the publisher wrote a reply, what they earn, where they bank, or who else buys from them.

Authors of software listed here without their involvement

Most of this catalogue was not published here. It is assembled automatically from public sources: the official MCP Registry, npm, PyPI, container registries, GitHub and other public code repositories, and public directories and lists of MCP servers and agent skills. Each entry is marked as not claimed. If you are the author of such an entry, this section is the notice the GDPR requires when data is not collected from the person it is about (Art. 14), and you can act on it without an account.

Where the data goes

Our main server is in Germany. We are a US company and run the service from outside the EEA, and several providers in section 05 — Stripe, Google, Amazon Web Services, GitHub, Anthropic and Cloudflare — process data in the United States or worldwide. Personal data is therefore processed outside the EEA, the UK and Switzerland.

For transfers to providers we rely on the safeguards in their data processing terms: an adequacy decision where one applies — including the EU–US Data Privacy Framework, its UK Extension and the Swiss–US framework, for recipients certified under them — and otherwise the European Commission’s standard contractual clauses, with the UK Addendum and Swiss amendments. You can ask us for a copy of the safeguards that apply; commercial terms may be removed from it.

How long each record is kept

We keep personal data only as long as we need it for the purposes in section 04, then delete or anonymise it. The periods below are what our systems do today; where no fixed period is set, the rule we apply is stated instead. We may keep data longer where the law requires it, to resolve a dispute, or while a legal claim is pending.

Data deleted from the live system disappears from backups as they expire. We restore a backup only to recover from an incident, and delete again anything that had been deleted before it.

What this site puts in your browser

Strictly necessary cookies and storage are used without asking, because the site cannot work without them. Analytics is the only optional category. You can change your answer at any time from Cookies in the footer of every page.

No analytics tag is configured at the moment, so no analytics script is loaded and no analytics cookie is set, whatever you answer. Your answer is still kept, and the table below lists what analytics would set if it were switched on.

Cookies

Browser storage

Browser storage is not sent with requests, except the two log IDs above, which go with the claim page’s and the wizard’s own log entries; it is read by the page in your browser and is not used for analytics or advertising. Clearing your browser storage removes it.

Pages load their typefaces from Google Fonts, so your browser sends a request to Google — with your IP address and browser details — when a page loads. We set no cookie for this.

What you can ask for, and how

If the GDPR, the UK GDPR or a similar law applies to you, you have the right to access your personal data, to correct it, to have it deleted, to restrict how we use it, to receive it in a portable format, to object to processing based on legitimate interests — and at any time to direct marketing — and to withdraw consent at any time, without affecting what was done before. Some of this you can do yourself:

Write to support@mcprush.com with “Privacy” in the subject, or use the contact page, and tell us the account email or the address of the entry. We may need to confirm who you are, and will ask for no more than we need — usually a reply from the account’s email address. Requests are free unless they are manifestly unfounded or excessive.

Some limits: we cannot delete what the law requires us to keep; we will not disclose data about other people; an organisation’s audit trail belongs to the organisation, so a request to change it goes to the account owner; and each publisher answers for the data its own software holds — we can tell you what we hold, not what they do.

You can complain to the data protection authority where you live or work, or where you think the problem happened — in the UK, the Information Commissioner’s Office; in Switzerland, the FDPIC. We have no establishment in the EU, so no single lead authority is responsible for us. We would rather hear from you first, but you do not have to.

Rights under US state privacy laws

Several US states — California, Colorado, Connecticut, Virginia and others — give residents rights over their personal information: to know what is collected and to access it, to correct it, to delete it, to get a portable copy, to opt out of its sale, of sharing for cross-context behavioural advertising, of targeted advertising and of significant profiling, and not to be treated differently for using these rights. Some of these laws may not apply to us because of their thresholds; we handle these requests the same way wherever you live.

Ask as described in section 12. An authorised agent can ask for you with your written permission; we may still ask you to confirm your identity with us directly. If we decline a request, you can appeal by replying to our answer; we respond within the time your state’s law sets, and if we still decline, you can contact your state attorney general.

Not for children

mcprush is a service for developers and businesses. You must be at least 18 to create an account. The site is not directed at children, and we do not knowingly collect personal data from anyone under 18. If we learn that an account holder is under 18, we close the account and delete its data; if you believe a child has given us personal data, write to us and we will delete it.

How we protect data, and what we cannot promise

• Connections to the site, the API and the gateway are encrypted.
• Passwords are stored only as salted hashes. API keys are stored as one-way hashes and shown to you once.
• Configuration values you give a server are encrypted in our database; for servers we host, they are stored as encrypted parameters in AWS and delivered only to the running server.
• Card and bank details are handled by Stripe and never stored by us.
• Staff access to the operator console is limited, and staff actions are logged.
• Backups are encrypted.

No system is completely secure, and we cannot guarantee that personal data will never be accessed, disclosed, altered or lost. To the extent permitted by law, we are not responsible for unauthorised access that happens despite reasonable measures, or that results from your own credentials or devices or from software you choose to install. Keep your keys secret, revoke a key you think has leaked, and give each server only the access it needs.

If a personal data breach happens, we notify the competent supervisory authorities and the people affected where and as the law requires. Under the GDPR, a notifiable breach is reported to the authority within 72 hours of our becoming aware of it where feasible, and to the people affected without undue delay where it is likely to result in a high risk to them.

When this policy changes

We may update this policy as the service or the law changes; the effective date at the top shows when the text in force took effect. If we make a material change, we tell account holders at least 30 days before it takes effect, by email or by a prominent notice in the account or on this site; any other change takes effect when it is published. A change the law requires may take effect sooner. Where the law requires your consent to a change, we ask for it. This policy is a notice about how we handle personal data, not a contract; the terms of service are the contract.

How to reach us

A complaint that a listing infringes a copyright or a trade mark is handled under section 16 of the terms, not as a privacy request.