This policy is for MCP Locker (mcplocker.com). Your locker is yours. We hold what is needed to run it, and nothing more. We do not sell your data, and we do not mine the MCP servers you connect.
You sign in with a link we send to your email. There are no passwords. We keep the address you sign in with so we can run your account, and we only email you about account activity such as those sign-in links.
When you add an MCP server, we store the name, address, and any credentials you give us, along with the tools that server exposes. We use this to run your locker. Only your account can access it.
Your locker has one address your agent uses to reach it:
https://mcplocker.com/my/<token>. The token in that
URL is the credential. Anyone who has it can call your tools, so keep
it private. You can replace it at any time, and the old address
stops working.
You connect servers you own or are authorized to use. We contact them to list their tools and to forward calls from your agent. Credentials you store are used only to contact those servers on your behalf. You are responsible for the servers you connect.
The MCP Locker extension is a side panel for the same account. When
you sign in on mcplocker.com in this browser, the
extension uses that session so the panel can show your locker.
On pages you visit, it looks only for WebMCP. If a page exposes tools, it reads those tool descriptions and the page host so the panel can show what the site offers. That stays on your device unless you add it to your locker. The extension does not scrape page text, form fields, or cookies.
If you add a server from the panel, the address and any credentials you enter are stored on your locker, the same as on the website.
The extension talks only to mcplocker.com and the services that run the product. It does not sell browsing data. Sign out in the panel clears the session from this browser. The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
We use Google to run sign-in, storage, and the website. Google Analytics counts visits to the public pages so we can see what is used. It is not used for advertising, and it is not tied to the contents of your locker. Mailgun delivers sign-in email. The MCP providers you connect process requests to them under their own terms.
MCP Locker is free for up to 5 MCP servers per account. We may change, suspend, or discontinue features, limits, or availability as the product evolves.
Provided as is
MCP Locker is provided as is and as available. We do not guarantee that the service will be uninterrupted, error-free, secure, or available at any particular time.
Your responsibility
You are responsible for the MCP servers you connect, the credentials you store, the agents you point at your endpoint, and the safety of your token. Keep your token private and replace it if it may have leaked. You are responsible for how your tools are called and for reviewing their output before relying on it.
Limitation of liability
To the fullest extent permitted by law, MCP Locker is not liable for lost data, security incidents, downtime, service interruptions, upstream provider failures, third-party tool behavior, or indirect, incidental, special, consequential, or punitive damages arising from use of the service.
Use and acceptance
By using MCP Locker, you accept these Privacy & Terms. If you do not agree, do not use the service.
If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, or delete your personal data, to request portability, and to lodge a complaint with your local data protection authority. To exercise these rights, email hello@mcplocker.com. We process personal data on the basis of providing the service you requested and our legitimate interests in operating and securing it.
Questions about this policy can be sent to hello@mcplocker.com.