Privacy Policy

• We collect what it takes to test your server and nothing more. There are no ads, no analytics trackers and no third-party cookies.
• We never sell your data, and nobody trains AI models on it — not us, and not the model providers that run your tests.
• The logins you give us for your servers are encrypted. They are used only for runs you start, and never lent to a teammate.
• A run records what your server sent back. That record is visible to your workspace, and its report to anyone else only if you share its link.
• You can delete your servers and your account yourself, and ask us for anything else at privacy@mcptester.dev.

MCP Tester is a service run by Neural Bridge AI, LLC ("Neural Bridge", "we", "us"). This policy explains how we handle personal information when you use mcptester.dev, and we are the controller of that information.

When you use MCP Tester for a company, that company decides which servers are tested and who joins its workspace. We process what its servers return on its behalf.

• Guests: people who use MCP Tester without signing in.
• Account holders: people who sign in with Google.
• Workspace members and invitees: people added to a workspace, or invited to one by email.
• People whose information passes through a server under test: if a server returns someone's data during a run, that data reaches us. The workspace that started the run decides what its server holds and is responsible for having the right to test it (see our Terms).

Your account

When you sign in with Google, we receive your name, email address and profile picture. We keep a small copy of the picture so we don't load it from Google on every page. We never receive or store your Google password, and we keep no Google access tokens.

Guest sessions

Using MCP Tester without an account creates a guest identity, stored in a cookie on your browser. It holds no name or email.

Servers you connect

We store each server's address, the name and icon it reports about itself, and which workspace it belongs to. We read its tool list each time you open its page; we don't keep the list on the server's record.

Logins you store

To reach a server that asks for one, we store your login to it: OAuth tokens from its sign-in screen, or an API key you paste. Each login belongs to one person and is encrypted before it is saved.

Runs

A run records how our agents tested your server: the tools they called, the arguments they sent, everything your server returned, the conversations of the assistant models, and the report at the end. Your login is removed from these records before they are stored.

Workspaces, invitations and payments

We store the workspaces you create or join, your role in each, and the email addresses you invite. When you add funds, Stripe sells them to you as our merchant of record and handles your card, your billing address and the receipt; we see the payment's result and amount, never the card number. We keep a ledger of every amount added to or spent from a workspace's balance.

Technical data

Our hosting providers log requests to the service: IP address, browser type, the page asked for and when. We use these logs to keep the service running and safe.

• To run the tests you ask for, and to show you and your workspace the results.
• To sign you in, keep your workspaces separate from everyone else's, and send the emails the product sends: invitations, and a note when your run finishes.
• To keep the service secure, prevent abuse, and fix what breaks.
• To keep each workspace's balance and account for payments.

We don't use your servers, runs or reports to advertise to you, and we don't build profiles about you.

Staff access. Nobody at Neural Bridge reads your runs or reports unless you ask us to (for example, to investigate a problem with a run), to investigate abuse or a security issue, or when the law requires it.

A run is carried out by AI agents, so what your server returns is processed by the model providers below. That is how the tests work, and it is the main reason to test with an account that holds test data rather than real customer data.

• Anthropic runs our test agents on its Claude models. It processes run data under its commercial terms, which don't allow it to train models on that data.
• OpenRouter carries the conversations of the assistant models you pick for a run. Those models come from Anthropic, OpenAI, Google, DeepSeek and Moonshot. Our account sends traffic only to endpoints that keep no data once a request is answered.

Neither we nor these providers use your servers, runs or reports to train AI models.

We never sell your personal information or share it for advertising. It reaches others in these cases only:

• Your workspace. Members of a workspace see its servers, its finished runs and reports, and its member list: names, email addresses and pictures. A run in progress is visible only to the person who started it.
• Anyone with a shared link. If a member shares a run, anyone holding its link can read that run's report. See Sharing a run.
• The providers that run the service, under contracts that limit them to doing so:

• When the law requires it, or to protect people, the service or our rights. We push back on requests that are too broad.
• If Neural Bridge is sold or merged, this information may pass to the new owner, and this policy continues to apply to it.

We use three kinds of cookies, all of them needed for the service to work. None tracks you across other sites.

We keep information while it's needed to run the service for you, then delete it.

Deleted data can stay in encrypted backups for up to 30 days before it is overwritten.

What a deleted account leaves behind. Workspaces belong to all of their members, so deleting your account doesn't delete the runs you started in a shared workspace. They stay with that workspace and stop naming you. To have those erased too, delete those runs or their servers first, or write to us.

• Logins to your servers are encrypted (AES-256-GCM) and can be read only by our server-side code. They never reach your browser or a teammate.
• During a run, your login is kept in a store that is locked to your server's address, so the agents can reach your server with it and nothing else.
• Each workspace's data is separated in the database itself, not just in our application code.
• We only connect to https:// addresses, and we refuse addresses inside private networks.

No system is perfectly secure. If a breach affects your information, we will tell you without undue delay and as the law requires. To report a vulnerability, write to security@mcptester.dev.

Wherever you live, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct it, if it's wrong;
• delete it;
• stop using it for a purpose you object to.

Some of this you can do yourself: delete a server from its page, leave a workspace from its dashboard, and delete your account from the account dialog. For the rest, write to privacy@mcptester.dev. We answer within 30 days, and we may need to confirm it's you first. We won't treat you differently for asking.

We rely on these legal bases:

• Contract: to provide the service you signed up for, run the tests you start, and take payment.
• Legitimate interests: to keep the service secure, prevent abuse and improve it. Where we rely on this, you can object.
• Legal obligation: to keep financial records and answer lawful requests.

You also have the right to restrict our processing and to move your data elsewhere. If you're not satisfied with our answer, you can complain to your local data protection authority.

In the past 12 months we have collected the categories described in What we collect: identifiers (name, email, IP address), internet activity (request logs), commercial information (purchases of funds), and the content of runs. We use them for the purposes in How we use it.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. You have the rights to know, delete and correct, which you can use as described in Your rights, including through an authorized agent.

Neural Bridge and the providers listed above process information in the United States and in other countries where they operate. When we move personal information out of the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, or on another lawful mechanism.

MCP Tester is a tool for developers and isn't meant for anyone under 16. We don't knowingly collect information from children. If you think a child has given us information, write to us and we'll delete it.

When we change this policy, we update the date at the top of the page. If a change materially affects how we use your information, we will tell signed-in users by email or in the product before it takes effect.

• Anything in this policy: privacy@mcptester.dev
• Security issues: security@mcptester.dev

Neural Bridge AI, LLC, 169 Madison Avenue, STE 2529, New York, NY 10016, USA.