Short version: there are no accounts here, nothing to log into, and nothing about you worth selling. The long version is below, because rules require it to be written down.
Anonymous usage statistics through Google Analytics: which pages are opened, roughly where from, which browser. This is aggregated — it says "forty people opened the catalogue today", not who they were.
Standard server logs: address, time, requested page, browser string. They are how we notice that a search engine crawls us or that something returns an error. Logs rotate and are not used for anything else.
That is the entire list. No accounts, no email collection, no forms, no newsletters.
Analytics sets its own cookies to tell a returning visitor from a new one. They carry no personal data.
One more is ours and holds a single thing: whether you switched the site to the light theme. It never leaves your browser.
Any of them can be blocked in browser settings — the site works fine without them. Analytics can also be opted out of with Google's own browser add-on.
There are no ads on the site today. If they appear, this page will say so before they do, and the security section will stay free of them: a page judging whether a server is safe cannot carry a paid block next to that judgement.
We fetch data from public sources: the official MCP registry, npm, PyPI and GitHub. We do not send them anything about you.
Everything the site publishes about servers and skills is public information plus our own measurements. If you are an author and a number about your project looks wrong, write to us — the correction takes one check.
If this policy changes, the date above changes with it. There is no mailing list to notify, by design.