Privacy

Last updated: September 25, 2026

Local CLI Scans

The MCP Signoff CLI runs locally by default. It does not upload scan results unless an explicit upload/API workflow is added and requested.

Public Website

The current website is static and hosted on GitHub Pages. Standard hosting logs may be processed by GitHub as part of operating the site.

Review Plan Assessment

When you request a review plan, MCP Signoff collects your email address, your five assessment answers, and the recommended review path. This information is used to provide your plan, understand your requested review, and contact you about that review. Requesting a plan does not subscribe you to a newsletter.

Your full plan opens on the page after your request is saved. Providing an email address does not verify that you own it, and the page does not claim that a copy has been emailed. If you request a scoped review, MCP Signoff also records that request with your assessment.

Do not include secrets, credentials, private configurations, or customer records in the assessment. Your email address is not included in the downloaded plan, browser URL, or assessment analytics events.

Payments

Payment processing is expected to be handled by Stripe Payment Links. Stripe may collect payment, billing, and fraud-prevention information under its own policies.

Audit Materials

Customers should not submit secrets, production credentials, customer data, or private configs through public issues. Sensitive materials should use an agreed secure transfer path after scope confirmation.

Data Minimization

MCP Signoff audit work should use the minimum materials needed to review MCP configuration, tool exposure, permissions, and remediation priorities.

Repository Boundary

Customer audit reports, private configs, payment records, and non-public prospect data should not be committed to the public MCP Signoff repository.