$ Privacy

In short

• We don't store or log the packages you check.
• We have no accounts, so we don't have your name or email.
• We don't use cookies, analytics or ads, and we don't sell anything.
• The code is public, so you can check all of this yourself.

Claude Code plugin and Docker

These run on your own machine. Your lockfiles, code and file paths stay there, and nothing reaches our server except the two list downloads below.

• Names and versions of public packages are sent to OSV.dev to look up advisories. Packages from private registries, git or local paths are left out where the lockfile shows that. Go, Java, .NET, requirements.txt, most pnpm and some Yarn lockfiles don't show it, so private package names in those can be sent, including in the check below.
• When something is affected, CVE numbers are sent to FIRST.
• When your agent runs a full check, which it may do when a session starts, the names of your direct dependencies are sent to deps.dev, run by Google, and Packagist, to see if they're still maintained.
• Once a day it downloads public lists from CISA, endoflife.date and this site. These downloads send nothing about your project, but like any web request they show your IP address.
• Results are saved on your machine for a day, in a cache folder or Docker volume, and not in your project.

Hosted URL

When you use https://mcp.keepmesecure.dev/mcp, your agent sends package names and versions to our server, which runs on Cloudflare Workers.

• We use them to answer that request, and then they're gone. We don't log or store them, and Worker logging is turned off.
• They're passed on to OSV.dev for the lookup, as above. Advisory data from OSV is cached, but your request isn't.
• Your IP address is used to count requests for rate limiting, held briefly in memory.
• Your agent is told to leave out private package names, but we can't enforce that. If your package names are sensitive, use the plugin or Docker instead.

This website

No cookies, no analytics, and nothing loaded from other sites. If you use the dark mode button, your choice is saved in your own browser.

Other companies

We can only speak for ourselves. These services have their own policies, and may keep their own request data, such as your IP address:

• Cloudflare hosts this site and the hosted URL. It also adds network error reporting.
• OSV.dev, run by Google, answers advisory lookups.
• FIRST and CISA provide risk data, endoflife.date provides support dates, and deps.dev and Packagist provide package release dates.
• GitHub hosts the code and the Docker image, and the MCP Registry lists it.

Questions

Open an issue on GitHub. To report a security problem, use the repo's Security tab instead. If this page changes, the update is visible in the repo's history.