Privacy policy

Who is responsible

mcpcost is an open-source project of Ondřej Úlehla, Czech Republic (ulehla.dev). He is the controller of the data that this page lists. For a question or a request, open an issue at github.com/ondraulehla/mcpcost. Do not put personal data in the issue: say what you need, and you get a private way to continue.

The MCP server and the API

The MCP server has five tools. All of them read; none changes data. It needs no sign-in and it does not know who you are.

What it gets

The arguments of a tool call: a server name, search words, or the URL of an MCP server. It does not get your conversation, your prompts, your files or your memory. It asks for nothing more than a tool needs.

What it keeps

Nothing in its database. A tool call writes no row. The host's request log keeps the address of the request for some days (see “The host” below).

check_server

This tool, and the live check on the website, connects to the URL you give. It sends initialize and tools/list with the client name mcpcost and no credentials. The operator of that server sees a request from Cloudflare's network, not from you. To count tokens, the tool definitions that the server returns go to the token counting endpoint of Anthropic. That endpoint counts and does not run a model. Give only URLs of servers that are public.

The answers

The answers hold data about MCP servers: status, tool names, token counts. They hold no data about you.

The website

Cookies

None. The choice of the light or dark theme stays in your browser (localStorage) and is not sent to us.

Visit counts

Cloudflare Web Analytics counts page views. It sets no cookie, makes no fingerprint and follows nobody from site to site. We see totals: pages, referrers, countries.

E-mail alerts

When you ask for alerts on a server, we keep your e-mail address, the server name, the times you asked, confirmed and stopped, and a hash of your network address that changes each month and stops misuse of the form. We use the address for the confirmation mail and the alerts, nothing else. A mail service (Resend) sends the mails for us. Each mail has a link that stops the alerts. A stopped alert stays in the database with its stop time; ask, and we delete the row.

Tracked servers

When you add a server outside the registry from the Check page, its URL goes on the public board and into /api/tracked.json. We keep the same monthly hash of your network address with it. Do not add a URL that must stay secret.

The host

The site runs on Cloudflare Workers with a Cloudflare D1 database. Cloudflare handles each request and keeps request logs (network address, user agent, URL, time) for some days. We read them as totals per network and per crawler to keep the site up, and we block crawlers that overload it. We do not sell data, we do not give it to advertisers and we do not use it to train models.

The companies that process data for the site: Cloudflare (hosting, logs, visit counts), Resend (alert mails), Anthropic (token counts of tool definitions) and GitHub (source code, issues, the daily probe). Some of them process data outside the European Union under their own terms.

Data about MCP servers

The board shows what public MCP servers answer to a client without credentials, and what the official MCP registry publishes about them: names, URLs, repository links, tool names and descriptions. This is data about software, published by its makers. If an entry shows something about you that must not be public, open an issue and we remove it.

Your rights

The law of the European Union (GDPR) gives you the right to get the data we hold about you, to have it corrected or deleted, to object to its use and to complain to a supervisory authority, in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz). The legal basis for alerts is your consent, which the stop link takes back. For logs and visit counts it is our legitimate interest in a site that stays up.

The board is for developers. It is not made for children. When this policy changes, the date at the top changes, and the history is in the repository.