Trust centre
Trust at mcpprobe.
A scanner sends traffic to your server and a report maps its weaknesses, so you should know exactly how we behave. This page summarises every commitment we make and links to the policy that makes it binding. Nothing here is a certification we do not hold.
Last reviewed
How scans behave
Deeper tests and hosted scans run only on servers whose owner has proven control. Opt-outs are checked before the first request. Default checks never call a tool and never write, modify or delete anything; requests are capped at 5 a second by default and 10 at most. Every request identifies itself as mcpprobe/0.1.0 (+https://mcpprobe.tech/scanning-policy).
Where your data lives, and for how long
The open-source CLI sends us nothing. Hosted data is processed in London (AWS eu-west-2), encrypted in transit (TLS 1.2 or later) and at rest (AES-256, evidence encrypted per account). Evidence is kept for 30 days on Free, 12 months on Team and 24 months on Business, then deleted; authorisation records for six years. Tool descriptions are not sent to any third-party AI model unless you turn that on.
Sub-processors
AWS (hosting, scan runners and evidence storage), Neon (database), Stripe (billing for paid plans) and Resend (verification and scan email). The full list with regions is available on request from hello@mcpprobe.tech.
Compliance status
mcpprobe does not hold SOC 2 or ISO 27001 certification and does not show badges for either. When that changes, this page will name the auditor and the report date. Findings are mapped to OWASP lists; that is not a certification either. A data processing agreement is available on the Enterprise plan.
Breach notification
If a personal-data breach affects hosted customers, we will notify the affected customers within 72 hours of becoming aware of it.
Reporting a vulnerability in mcpprobe
Write to security@mcpprobe.tech. We acknowledge reports within 2 business days, agree a fix timeline with you, and do not pursue good-faith research that follows the policy.
Vulnerabilities we find in other people's servers
Our research runs only against open-source packages in a sandbox we control. We report privately to the maintainer within 72 hours, wait 90 days before any public mention, and never name an unpatched server. Customer scan results are never part of this research.
Open source
The scanner CLI and GitHub Action are open source, so you can read exactly what a scan sends. Version 0.1.0 is MIT-licensed; releases from v0.2 will be Apache-2.0. The checks catalogue, with each check's probe, evidence and known false positives, is public.
Status
Service availability will be published on the status page once hosted scanning opens. Until then it says so, rather than showing a green light for a service that is not running.
Legal
Terms of service, privacy notice and acceptable use policy.
Company details
mcpprobe is a trading name of ORGANIC VILLAGE(UK) LIMITED, registered in England and Wales under company number 11783758.
Need more for a security review?
Write to hello@mcpprobe.tech with your questionnaire or the questions you need answered.