Acceptable use policy

You may

• Scan MCP servers and stdio packages you own or are authorised in writing to test.
• Run active checks against tools you have put in scope for a verified target.
• Publish your own report and badge, and share findings about your own systems.
• Use the CLI in CI against staging and production targets you control.

You may not

• Scan, or attempt to verify, a target you are not authorised to test.
• Work around verification, scope limits, rate caps or opt-outs, including by modifying the CLI to hide its user-agent while scanning hosts you do not own.
• Use findings to access, change or extract data from a system beyond proving the issue.
• Supply credentials that belong to someone else, or that grant access beyond a test account.
• Use the service to probe a third party through your own server's tools.
• Resell scan capacity, or run scans on behalf of others without their written authority.

What happens if this policy is broken

We stop the scan, suspend the account, keep the authorisation records as evidence, and may notify the affected host owner. Where the law requires it, we report to the relevant authority.

Reporting misuse

If you believe mcpprobe was used against your system without authority, email abuse@mcpprobe.tech with the time range and the source address from your logs. Scan ids in our user-agent resolve to the authorisation record, which we will share with the verified owner of the host.