Security — MCPBay

1. Overview

This page lists the security measures that are in place on MCPBay today — for your account, for the API keys you store with us and for the MCP servers we host. It describes what is actually implemented, not plans.

No certification claims. MCPBay does not currently hold a SOC 2, ISO 27001 or similar certification, and no third party has audited the measures below. How we handle personal data is described in the Privacy Policy and on the GDPR information page.

2. Infrastructure and transport

All traffic to mcpbay.pro is served over HTTPS with automatically renewed certificates; plain HTTP is redirected to HTTPS.
Browsers are told to use HTTPS only (HSTS, one year, including subdomains), and the site sends nosniff and a strict referrer policy.
The database is not reachable from the internet, and administrative access is restricted.
Each service connects to the database with its own role that has only the permissions it needs; many sensitive writes go through narrowly scoped database functions.

3. Accounts and sign-in

Passwords are stored only as strong one-way hashes, never in plain text.
Optional two-factor authentication with an authenticator app, with one-time recovery codes.
“Remember this device” is time-limited, never skips the password, and is revoked when you change your password or turn off 2FA.
Session cookies are protected from scripts and cross-site requests and expire automatically; changing your password signs out your other sessions.
Sensitive account actions, such as changing your email or password or deleting your account, require your current password.
Password-reset links are short-lived and work once; email-confirmation links are short-lived. The reset form does not reveal whether an email is registered.

4. API keys you store with us

Some MCP servers need your own key for a third-party service. When you save such a key in your account:

Keys are encrypted with strong, industry-standard encryption, and the encryption keys are kept separately from the database.
An encrypted key can be used only for the account and server it was saved for.
After saving, only the last four characters are shown back to you. Key values are never written to logs, and access to keys is recorded.

What this protects against. Encryption protects the keys if a copy of the database leaks. The key is decrypted only when a server you use needs it — and that server then receives your key to call the third-party service on your behalf. Store keys only for servers whose authors you trust.

5. Connecting AI clients

AI clients connect to MCP servers hosted on MCPBay through standard OAuth 2.1 sign-in.
Access tokens are short-lived and valid only for the server they were issued for.
Long-lived sign-ins are protected against token theft: signs of token reuse revoke access.

6. MCP servers hosted on MCPBay

Each hosted server runs in its own isolated environment and can be reached only through MCPBay.
A server accepts a request only from a user signed in with MCPBay; your MCPBay credentials are not passed on to the server’s code.
Every build is checked automatically before release; critical security issues block the release.
Secrets a developer sets for their server are kept in a dedicated secret store, never in our database or logs.
Tool descriptions of every server — hosted or not — are checked automatically and re-checked on every update. More about server checks.

7. What we record about tool calls

For your per-user usage statistics we record only which tool was called, whether it succeeded, how long it took and whether the call was paid — not the arguments you send or the content the server returns.

8. Reporting a vulnerability

If you believe you have found a security issue in MCPBay, please email support@mcpbay.pro with a description and steps to reproduce. Please do not access other people’s data, do not degrade the service, and give us reasonable time to fix the issue before disclosing it publicly. We read every report and aim to reply within a few business days.

Our contact details are also published in security.txt. To report a suspicious MCP server in the catalog, use the same address and include the server page link.