Privacy policy

MCP Heartbeat is a public directory and uptime checker for Model Context Protocol (MCP) servers, operated at mcpheartbeat.com. This policy describes the information we collect, how we use and store it, when it is shared, how long we keep it, and how to contact us.

Data we collect

Directory measurements

We probe MCP endpoints that appear in the Official MCP Registry, in our manual seed list, or that someone submits. A probe sends initialize, notifications/initialized, and tools/list only. It never sends tools/call. We store the public results of those probes: reachability, protocol and tool metadata, latency, and check outcomes. Those measurements are published on this site and through our MCP endpoint and JSON API.

Use of the site, MCP endpoint, and API

When you use the website, the MCP server, or the JSON API, we store a hashed network address, the user agent, an optional client name, the tool or route called, a timestamp, and whether the request was rate-limited. The hash is an HMAC of the address with a server-side salt. Raw IP addresses are not stored.

Submit and claim forms

If you submit a server or claim a listing, we store the name, email address, optional role and message, the endpoint URL or listing identifier, a hashed network address, and a timestamp. Claim requests also store a verification token. Email addresses are not shown on the public site.

Accounts and cookies

The directory and the MCP endpoint do not require an account. We do not use advertising or analytics cookies. Hosting infrastructure may set strictly necessary cookies or keep operational request logs.

How we use and store information

We use this information to:

• operate the directory and publish automated measurements
• enforce rate limits and reduce abuse
• process submissions and listing claims
• keep the service reliable

The site is hosted on Vercel. Application data is stored in a Postgres database provided by Supabase. Those providers process data only as needed to host the service.

Sharing

We do not sell personal data. We do not publish the email addresses collected on forms. We share personal data only with the hosting and database providers that run the service, or if we are required to by law.

Public measurement results about MCP servers, and catalog metadata from the Official MCP Registry (CC0), are published on the site and through our APIs. That is information about public servers, not about visitors.

Retention

Directory measurements are kept for as long as the directory operates, so historical uptime and latency remain available. Hashed request logs and form submissions are kept as long as needed to operate the service and to prevent abuse. We may delete older logs and stale submissions or claims from time to time. Claim verification tokens are kept until the claim is resolved or becomes inactive.

Contact

For privacy questions, or to ask us to correct or delete form data we hold about you, email support@mcpheartbeat.com.