Local-first software
MCP Forge is designed to run on infrastructure controlled by the operator. The software does not require a hosted MCP Forge account and does not intentionally transmit database contents, API responses, credentials, queries, or tool calls to Built by Kris.
Information stored by MCP Forge
The local runtime may store connection definitions, OpenAPI documents, approved queries, server definitions, and operational configuration in its local data directory. Depending on how you configure it, connection definitions may contain credentials. Operators are responsible for securing that directory, using encrypted disks or volumes, restricting access, and maintaining backups.
Database and API traffic
When a tool is called, MCP Forge sends the approved query or request directly to the database or API selected by the operator. Those systems may maintain their own logs and are governed by their respective privacy policies and organizational requirements.
Website information
The static website included with MCP Forge does not include analytics, advertising pixels, account registration, cookies, or contact forms. A hosting provider may still record standard access logs such as IP address, browser type, requested page, and timestamp.
AI clients
When you connect MCP Forge to an AI client, information returned by a tool may be sent to that AI provider as part of your conversation. Review the AI provider’s privacy terms and configure MCP tools to return only the minimum data necessary.
Security recommendations
- Use dedicated, least-privilege database and API accounts.
- Prefer read-only queries and retain the default read-only enforcement.
- Protect endpoints with a strong bearer token, HTTPS, and network restrictions.
- Do not commit
config.json, environment files, exported configurations, passwords, or tokens. - Review tool descriptions, inputs, and returned fields before giving users access.
Data deletion
Because configuration is stored locally, the operator controls deletion. Stop MCP Forge and securely remove the configured data directory and any associated backups. Deleting MCP Forge data does not delete logs or data retained by databases, APIs, AI providers, reverse proxies, or hosting providers.
Business deployments
The organization deploying MCP Forge is normally the controller of information processed through its tools. That organization is responsible for notices, legal bases, retention, access controls, data-subject requests, and regulatory obligations applicable to its use.
Changes
This privacy page may be updated as the product changes. The revision date at the top identifies the current version.
Contact
For privacy or support questions, email support@builtbykris.com. Do not include credentials, tokens, personal records, or complete connection strings in support messages.