Security and data,
for your security team
What QAmcp touches, where your data goes, and what it never does. Everything here can be checked in the open-source code.
Last updated 27 October 2026
Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions
What QAmcp touches, where your data goes, and what it never does. Everything here can be checked in the open-source code.
Last updated 27 October 2026
| How you run it | What leaves your network | What we keep |
|---|---|---|
| Terminal tool, Docker or your CI | Only the requests to the server you test (and its login service) | Nothing. We never see it |
| Website test on qamcp.dev | The server link and the results pass through our test service | The report (link and results). API keys and login passes are never saved |
| Monitor | The server link and results pass through our test service, every hour | Your email, the server link and its test history |
For a server inside your company, run the terminal tool or the Docker image on your own machines: it can test servers that are only reachable inside your network, and nothing comes to us.
--look-only runs no tools at all.QAmcp is young and made by one person. We don't have a security certification such as SOC 2 or ISO 27001, and we won't claim one until we do. If your company needs a questionnaire filled in, a data agreement or a private setup, email hi@qamcp.dev.
Please tell us privately, as described in our security policy, not in a public issue.
See also: Privacy and terms · What QAmcp can and can't catch · Safety