Privacy Policy

The short version

The MCP servers require no account, no sign-in, and no API key of ours. We do not store the questions you ask them, the answers they return, your IP address, or your user agent. What we keep is a daily count of how many times each tool was called, which MCP clients connected, and roughly how many distinct callers there were — aggregate numbers with no per-person record behind them.

We do not sell personal information, and we do not use anything collected here to train machine-learning models.

The MCP servers

What is recorded

Each server keeps an in-memory tally that is flushed to a daily rollup table about once a minute. A row is a date, a server, a metric name, and a count. The metrics are:

• the number of completed connection handshakes;
• the number of calls to each tool by tool name, how many of those returned an error, and the total time they took;
• the name each client reports for itself during the MCP handshake — for example claude-code or cursor — truncated to 40 characters;
• error categories, with identifiers, quoted strings and numbers stripped out so that one row cannot come to represent one person;
• a count of distinct callers per day (see below).

How distinct callers are counted

To know whether ten calls came from one person or ten, the server hashes the calling IP address with SHA-256, salted with the current UTC date, and keeps the first 16 hex characters in memory for the rest of that day. Only the size of that set is ever written down. The hashes themselves are never stored, and because the salt changes at midnight UTC, a hash from one day cannot be matched against a hash from another. The raw IP address is never written to disk.

What is deliberately not recorded

No request or response payloads. No tool arguments — not the control you looked up, the keyword you searched, or the entity you queried. No raw IP addresses. No user agents. No cookies; the MCP endpoints do not set any.

Data that leaves our systems

Two tools on the Federal Market server are relays. When you call them, your search terms are sent to the upstream government API in order to answer the question, and that API's own terms and privacy practices apply to what it does with the request:

• SAM.gov (api.sam.gov, operated by the U.S. General Services Administration) — for contract opportunity search and entity lookup.
• USASpending.gov — for federal award search, award detail, agency and NAICS lookup, and spending rollups.

The CMMC/NIST 800-171 and STIG servers make no outbound calls at all. They answer from a corpus compiled from public NIST and DISA publications and shipped with the server.

If you supply your own SAM.gov API key

The Federal Market server accepts a caller-supplied SAM.gov key, either as the X-Sam-Api-Key header or as a sam_api_key tool argument, so that you spend your own quota rather than our shared one.

That key is held only for the life of the single request it arrived on. It is forwarded to api.sam.gov and then discarded. It is never written to a database, never written to logs, and never used for any request other than yours. Responses fetched with your key are also kept out of the shared response cache, so no other caller can be served a result your key paid for.

Caching

Results fetched with our shared SAM.gov key are cached in memory to protect a limited daily quota — up to 500 entries, for six hours for opportunity searches and 24 hours for entity lookups. The cache is keyed by a hash of the query parameters, holds only the government API's response, and is lost whenever the process restarts. Nothing in it identifies who asked.

The website

Site analytics run on a self-hosted Umami instance at stats.mactechsolutionsllc.com, which we operate ourselves. It is cookieless, records page views and referrers in aggregate, and does not build a cross-site profile of you. No third-party advertising or tracking scripts run on this site.

If you submit the contact or feedback form, we receive what you typed — typically a name, an email address, and your message — and use it to reply to you and to keep a record of the enquiry. The message is delivered to us through Resend, an email delivery provider, which processes it in transit.

Client portal and Suite areas of this site require an account. If you have one, we hold the account details you or your organization provided and the records you create there, under the contract or engagement that gave rise to the account. Those areas set session cookies that are strictly necessary for sign-in.

Retention

• MCP usage counts — kept indefinitely as daily aggregates, because they identify no one. The hashed-IP sets behind the distinct-caller count are discarded within about a day and never persisted.
• Shared-key response cache — 6 or 24 hours, and cleared on every deploy.
• Contact and feedback messages — kept while the enquiry is open and for our ordinary business records afterwards; ask us and we will delete yours.
• Account and engagement records — for the term of the engagement and any retention period the governing contract or federal regulation requires.

Who we share with

We do not sell personal information and we do not share it with advertisers. Data reaches third parties only in the ways described above: the government APIs that answer relayed queries, our hosting provider (Railway) which runs the servers and database, and Resend which delivers form mail. We may disclose information where the law requires it.

Security

All endpoints are served over HTTPS. MacTech Solutions is a defense contractor and operates its own environment to the NIST SP 800-171 control set; the public MCP servers are deliberately kept outside any boundary that handles Controlled Unclassified Information, and none of the data described on this page is CUI.

Your choices

You can use the MCP servers without giving us anything that identifies you. For information we do hold — a contact message, a portal account — you may ask us for a copy, a correction, or its deletion, and we will act on the request unless a contract or federal record-keeping obligation requires us to keep it. Write to the address below.

These services are not directed at children and we do not knowingly collect information from anyone under 13.

Changes

If this policy changes materially we will update the effective date at the top and, for changes that affect the MCP servers, note it on the MCP hub page.