Privacy
Toolcard is a small service on this server. There is no account and no payment.
What a check stores
Nothing from POST /v1/check, POST /v1/check-server, or the MCP tools check_tool and check_server is written to the outcome file. The tools you send are held in memory only long enough to answer. Reading an MCP resource returns that public answer page and stores nothing.
What a report stores
POST /v1/outcomes and the MCP tool report_outcome append one row: time, tool name, whether the name is endpoint-shaped, SHA-256 of the description if you sent one, called or ignored, an optional client label (up to 32 characters, no email), and an optional report id. The raw description and the input schema are not stored.
The public summary is counts only. It does not list tool names. Raw rows stay on this server, are not committed to git, and are not published as a file.
What you should not send
Do not send secrets, access tokens, personal data, or customer data. A hash is not a reason to send them.
Logs
The web server writes an access log with IP address, user agent, path, and time. That log is for operating the site. It is not merged into the outcome file. Rate limits use the IP in memory and are forgotten when the process restarts.
Contact
There is no public contact address yet. This page will list one before the service takes payment.