MCPTriage

Privacy policy for SkillTriage (skilltriage.moorai.dev) and MCPTriage (mcptriage.moorai.dev), one free service run by MoorAI. It covers the web pages, the API under /api/v1/ and the MCP endpoint at /mcp. Last updated 2026-10-31.

What you send

A pasted file (a skill, an MCP config or any text file), a package reference such as npm:name@1.2.3, or a package name to look up. No account, key or email address is asked for.

What is stored

Content-free records only, in one database on the server:

• A pasted file: a random id, the time, the verdict, a SHA-256 hash of the text (so an identical paste is answered from cache), the filename reduced to letters, digits, dots, dashes and underscores, whether an inline signature block was present, and the content-free findings (threat id, category, tier, file path, a hash and intent labels). For an MCP config, each launch's position, ecosystem and how its version is pinned. The text itself is written to a temporary directory, scanned and deleted; it is never stored, and neither is any matched snippet, server name, argument or environment value.
• A package scan: the public package name, path and version you asked for and the version it resolved to, the verdict, the content-free findings, the registry checks' results, the download's checksum and the package's public repository URL. Never the package's files.
• A verdict lookup is not stored.

Records have no automatic expiry, so that permalinks keep working. A scan's permalink is not listed anywhere, but anyone who has the link can open its verdict and findings.

Your IP address

Your IP address is used only to apply the rate limits. The counters are kept in memory, never written to the database or to logs, dropped within about 70 minutes of your last request, and lost whenever the service restarts. The application writes no request logs. The service runs behind its hosting platform's reverse proxy, which sees your IP address and the URL you request in order to route the connection.

Requests made on your behalf

A package scan downloads that package from its registry (npm, PyPI) or from GitHub, and an npm or PyPI scan also reads public metadata from the registry, from the repository the package declares on GitHub or GitLab, and from the official MCP Registry. These requests come from the server and carry public package names and versions only, never your IP address. A pasted file and a verdict lookup cause no outside requests.

Cookies and tracking

This service sets no cookies, runs no analytics or tracking, and loads no third-party scripts, fonts or images. Every page is served from this host.

Through a gateway

If you reach the MCP endpoint through a third-party directory's gateway or proxy rather than connecting to https://mcptriage.moorai.dev/mcp directly, that third party sees your requests under its own terms.

Hosting

The service runs on a virtual server rented from Hostinger, in an address block registered in the United States.

Contact

Questions, corrections or a request about a record: https://moorai.dev/contact.html. Give the permalink of the record you mean; records hold nothing that identifies who made them.