Report a security issue

If you think you've found a security problem in MCP Checkup, email security@mcpcheckup.com. Please don't open a public issue or share details publicly until we've had a chance to fix it.

What to include

• The URL or feature affected
• Steps to reproduce
• What you expected and what happened instead
• How to reach you

We confirm receipt within 5 business days and keep you updated until the issue is resolved.

When testing, use only your own account. Don't access or change data that isn't yours, and don't run load or denial-of-service tests.

In scope

mcpcheckup.com and its pages, the /mcp endpoint, the probe that checks MCP servers on our behalf, and the public verification code at github.com/mcpcheckup/checks.

Out of scope

• MCP servers listed in our directory. We don't run them; please report problems to their maintainers.
• Denial-of-service and load testing.
• Social engineering and physical attacks.
• Automated scanner output without a demonstrated impact.

We don't run a paid bug bounty.

Machine-readable contact details are at /.well-known/security.txt.