What a scan does, what it never does, and how to make it stop.

1. We only scan verified targets

Active checks and hosted scans run only after the person scanning has proven control of the host with a DNS TXT record (mcpprobe-verification=<token> at _mcpprobe.<host>), or, for stdio servers they run themselves, local verification. Verification is re-checked before every scan and expires after 90 days. There are no “teaser” scans of unverified servers, including servers listed in public registries.

2. Every active scan carries an authorisation record

Who authorised it, when, by which verification method, the scope (which tools may be called), the exclusions, and the rate cap. The CLI writes it next to the report (scan.authorisation.json); hosted scans retain it for six years. It is available to the host owner on request.

3. We identify ourselves

Every request carries this user-agent and comes from a published IP range.

The CLI sends exactly this user-agent. Hosted scans will append a scan id that resolves to the authorisation record. The IP list is empty until hosted scanning launches; ranges are published there before the first hosted scan. Current IP list.

4. What a scan never does

• Never writes, modifies or deletes data on your server
• Never exploits a finding beyond the minimum needed to prove it
• Never calls a tool outside the approved scope, and never calls tools flagged destructive
• Never exceeds 5 requests per second by default, and never more than 10 whatever the setting
• Never stores credentials you supply beyond the scan that uses them
• Never touches a host that has opted out

5. Your data

Processed in

London, United Kingdom (AWS eu-west-2)

Evidence kept

30 days (Free), 12 months (Team), 24 months (Business), then deleted

Authorisation records

6 years

Third-party LLMs

Tool descriptions are not sent to any third-party model unless you enable the optional judge; when enabled, the provider is named in your account and in the report

Sub-processors

AWS (hosting), Neon (database), Stripe (billing), Resend (email). Full list with regions on request.

Encryption

TLS 1.2+ in transit, AES-256 at rest, evidence encrypted per account

More detail on the security page and in the privacy notice.

6. Responsible disclosure

Our public “state of MCP server security” research runs only against open-source packages in a local sandbox we control, never against third-party hosts. When research finds a vulnerability in someone else's server:

• We report it privately to the maintainer within 72 hours
• We give 90 days before any public mention, longer if a fix is in progress
• We never name an unpatched server in aggregate reports
• We request a CVE on the maintainer's behalf if they want one

Found a problem in mcpprobe itself? Write to security@mcpprobe.tech; our security.txt is published. We acknowledge within 2 business days. Full policy.