Privacy Policy

When an AI assistant calls one of our tools on your behalf, we receive:

• The tool's inputs: the repository, package name and optional version, MCP server URL, or agent identifier you asked about, and whether to re-scan.
• Standard request data: the IP address and User-Agent of the request.

Our tools accept only those inputs. We do not ask for your conversation, chat history, memories, files, name, email address, or account with the assistant, and we do not store anything beyond the inputs listed above. Your assistant decides what to put in those inputs; they are short identifiers such as a package name or URL. Some assistants attach optional hints to a request (for example a coarse location or an anonymous identifier); we do not read or store them. The connector has no sign-in.

We use the inputs only to run the check you asked for: we fetch public information about that tool from its source (GitHub, the package registry, or the MCP server itself), analyze it, and return the result. All eight tools are read-only: they never change anything in your accounts or in the tool being checked.

• Server logs (IP address, User-Agent, the requested path including the tool checked, time, status) are kept to operate and secure the service. They are rotated automatically and typically kept for less than 30 days.
• Usage metrics are daily counts (for example, calls per tool and per assistant product). To count distinct callers we store a one-way hash of the IP address and User-Agent combined with a salt that changes every day, not the IP address itself. Metrics are kept for up to 90 days.
• Cloudflare Web Analytics measures page loads and does not use cookies. It receives the address of the pages you view, without the query string. It never receives the address of a check result page (any page under /check/, whose address names the tool you checked or, for a private scan, your repository): it does not run on those pages, and once you open one from another page it sends nothing more until you reload.
• Our own site analytics do not use cookies either, and are stored in our own database. The first time you open agentavow.com, our code stores a random identifier called ag_session_id in your browser's local storage. It holds no name or email address. It stays until you clear your browser's data for our site, and your next visit then creates a new one. If you create an account on our /register page, we link the identifier to that account.
• What those analytics record: pages you view, submitting a check box (not what you typed), results shown, clicks on our add and install links, copies of an install command or a badge, and steps in creating an account. Each record holds the event, the identifier, the page path, the time, and the IP address of the request. On a check page the path names the tool you checked. The query string is left out, so an MCP server URL given there is not recorded, and a one-time private scan is recorded as /check/private with no repository name.
• Campaign links: if you arrive through a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), your browser keeps them in session storage as ag_utm until the tab closes and sends them with each event. It also keeps a marker, ag_landed, so a landing counts once per tab. We store the first tags we see for an identifier, with the page it landed on, so a later visit from the same browser counts toward the same campaign.
• How long: these analytics records have no automatic deletion date. You can ask us to delete them (section 8).
• Meta Pixel, on /claude-code only: /claude-code is the page our ads on Facebook and Instagram lead to. That page, and no other page on agentavow.com, loads the Meta Pixel, a script from Meta Platforms (connect.facebook.net), so we can measure how many people our ads bring there and how many copy the install command. It never runs on a check page. When it runs, your browser sends Meta a page-view event and, the first time you copy the install command, one copy event. With them Meta receives the page address (including any campaign tags in it), the page you came from, your IP address and browser details, and any cookies your browser already holds for facebook.com. The pixel may also set its own cookie on agentavow.com, _fbp, which Meta uses to recognize the same browser later. We do not send Meta your name, email address or any other contact details (no Advanced Matching), we turn off its automatic collection of button clicks and page details, and we send Meta nothing from our servers. Meta uses this data under its own privacy policy, including to measure and improve ads, and may use it to choose ads it shows you. To opt out: turn on Global Privacy Control or Do Not Track in your browser and the pixel is not loaded at all; or block connect.facebook.net with your browser or a content blocker; or turn off activity from ad partners in your Meta ad preferences. Clearing your cookies for agentavow.com removes _fbp.
• Error reports are sent to our error-tracking provider (Sentry) to fix bugs.