Privacy Policy | MCP Hunter
MCP Hunter

Privacy Policy

Last updated: 2026-08-04

This policy explains what MCP Hunter ("we", "us", "our") collects, why, and what you can do about it. It covers the service at https://mcp-hunter.com.

We handle personal data under the EU General Data Protection Regulation (GDPR). MCP Hunter is operated from the Netherlands.

1. Who we are

If you have a concern about how we handle your data and we cannot resolve it directly, you can lodge a complaint with the data protection authority in your country of residence. In the Netherlands that is the Autoriteit Persoonsgegevens.

2. The service in plain language

MCP Hunter is a weekly launch board for products that ship an MCP server. Makers submit a product, the community votes, and each week produces one ranked board at a permanent URL.

Before a product is listed, we connect to the MCP endpoint the maker gave us, call tools/list, and record what came back. The listing is built from that answer.

We check once, at submission, and never again. Every verification claim on this site is past-tense and dated for that reason.

We do not rate security or safety. We have not audited any listed server's code, its data handling, or its permissions. A listing means a server answered us on a date. It does not mean the server is safe.

3. What we collect

3.1 If you only read the site

Nothing that identifies you. There is no analytics product on this site, no tracking pixel, and no advertising network. We set one cookie, described in section 6.

Our server and our CDN keep short-lived request logs (IP address, timestamp, URL, user agent) as a normal part of serving and protecting the site.

3.2 If you sign in

Signing in is only needed to vote or to submit, and GitHub is the only method. From your GitHub profile we receive and store:

  • Your GitHub account identifier, used to recognise you on return visits
  • Your display name (or your username if no name is set)
  • Your avatar image URL
  • The date your GitHub account was created
  • Your email address, if your GitHub profile exposes one. If GitHub withholds it, we store GitHub's own @users.noreply.github.com form instead, which names the account without inventing an address.

We never receive your GitHub password. We request no write access to your repositories.

The account creation date is stored because a brand-new account is a signal we use against vote manipulation.

3.3 If you submit a product

  • The product name, tagline, and the URLs you provide: the MCP endpoint, the product page, and optionally a repository and documentation link
  • A one-time verification token we generate to prove ownership
  • The result of our connection test: whether it connected, the tool count, the tool names and descriptions the server returned, response time, and any error
  • The product site's icon, fetched once from the domain you gave us and stored as an image
  • Review notes we write while deciding whether to list it

A test credential, if you give us one. Some MCP servers require a token to answer at all. That field is optional. If you use it, the value is encrypted at rest, sent only on that single check, and deleted once the check finishes, whether it passed or failed.

3.4 If you vote

We store which account voted for which product, the time, and the IP address the vote came from. The IP is kept to detect vote manipulation, which is the one thing that would make a ranked board worthless.

3.5 If you tell us your server is stdio-only

We store your account and the product URL you entered, so we can count how many makers a Streamable-HTTP-only rule turns away. Nothing else.

4. Why we are allowed to hold it (legal bases)

  • Contract: account data, submission data, and votes. You asked us to list or rank something and we cannot do that without them.
  • Legitimate interests: request logs, the vote IP address, and the GitHub account age, all for security, abuse prevention, and keeping the ranking honest. We think a board that can be trivially gamed serves nobody, and these are the least intrusive signals we found that work.
  • Consent: nothing currently relies on consent, because we run no analytics or marketing.

5. What we publish

A listed product is public by design: its name, tagline, links, the dated connection-test result, its vote count, and its position on that week's board.

The maker's identity is not published. We do not show who submitted a product, and we do not show who voted for what.

Past weeks stay online permanently at /week/{year}/{week} and are never redirected. That is the point of the archive, so treat a submission as a public, permanent record.

6. Cookies

One cookie, set only to keep you signed in and to protect forms against cross-site request forgery. It is strictly necessary for the site to function, so it does not require a consent banner under the ePrivacy rules.

We set no analytics, advertising, or third-party tracking cookies. There is no consent banner because there is nothing to consent to.

7. Who else touches the data

We keep the list short on purpose.

Who What they do Where
Hetzner Online GmbH Hosts the server the site runs on Germany (EU)
Cloudflare, Inc. DNS, CDN, and the firewall in front of the site Global edge, US company
GitHub, Inc. Sign-in, when you choose to sign in US

We do not sell personal data, and we do not share it for anyone else's advertising.

Transfers outside the EU (Cloudflare, GitHub) rely on the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

We send no email. Sign-in is handled entirely by GitHub, so there is no mail provider in this list.

8. How long we keep it

  • Listings: permanently. The weekly archive is a public record and is never redirected or deleted.
  • Account data: until you delete your account.
  • Votes: as long as the vote stands. Withdrawing a vote removes it.
  • Test credentials: deleted as soon as the check finishes. They are never retained.
  • Request logs: short-lived, typically days, and rotated automatically.

If you delete your account, we remove your personal data. A product already listed on a past week's board stays listed, because the archive is a public record of what launched that week. It simply stops being connected to your account.

9. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable form.

You do not have to ask us for the common ones. Sign in and go to Account, where you can see exactly what we store about you, withdraw a submission, and delete your account yourself.

For anything else, email [email protected]. We reply within 30 days.

10. Security, stated honestly

The site runs over HTTPS. Test credentials are encrypted at rest and deleted after use. Administrative access to the server is restricted to a private network.

Connections to submitted MCP endpoints are made from a queued background job with a hard timeout, and private, loopback, and cloud metadata addresses are blocked, because a submitted URL is an untrusted address by definition.

No system is perfectly secure, and we are not going to claim otherwise. If you find a vulnerability, email [email protected].

11. Children

MCP Hunter is for people shipping software and is not directed at children under 16. We do not knowingly collect their data.

12. Changes

If we change this policy we update the date at the top. Material changes will be noted on the site.