Privacy
What mcpbus keeps on your computer and the two things it sends.
Last updated: 29 October 2026
In short
mcpbus runs on your computer, with no account. mcpbus never sends us your connections, credentials or database contents. It sends us two things: an update check, which is always on, and a usage count with no name or contact details, only a random install ID, which you can turn off.
The data controller is Offe Consulting AB (559476-2774), Lövsbergsvägen 109, 589 37 Linköping, Sweden. Contact: hello [at] mcpbus [dot] sh.
What stays on your computer
mcpbus stores the following in %LOCALAPPDATA%\mcpbus\:
- Your connections, exceptions and global settings.
- Database passwords and client secrets, encrypted with Windows DPAPI for your Windows user.
- The hashing key (
mcpbus.key). - Logs (
logs\mcpbus.log, three files of up to 5 MB each) with server, connection, database, login and user names, auth types, summaries of tool calls, error numbers, times and row counts. They include your config folder's path, and with it your Windows user name. SQL, object names, data and credentials stay out of the logs. - The random install ID and status files: the latest version seen, usage-count state, a setup receipt, a snapshot of your effective security settings (without secrets), the config UI's session token and databases waiting to be prepared.
- mcpbus.exe itself (
bin\mcpbus.exe), if you used the install script.
The config UI also writes a small log (two files of up to 1 MB) and port files to %TEMP%. Setup registers mcpbus in your MCP clients' config files (Claude Code, Claude Desktop, VS Code), pre-approves the mcpbus tools in Claude Code's settings.json and adds mcpbus to your PATH.
mcpbus uninstall removes the registrations, the Claude Code tool permission and the PATH entry. --remove-data also removes the folder and the %TEMP% files. First it saves a script to your Documents folder that a DBA can run to remove the mcpbus database users. The script names your connections, servers and databases.
mcpbus has no crash reporting, error reporting or other analytics.
What mcpbus sends
| Call | What is sent | When |
|---|---|---|
| Update check | Only the request: no ID, version or other data. The reply lists the latest version and the oldest supported one, and mcpbus compares them with its own version locally. Nothing from the request is stored. | At startup, at most once every 12 hours. Sent to api.mcpbus.sh, with GitHub as a fallback. Always on. |
| Usage count | A random install ID, the mcpbus version and the database engines your connections use (mssql, postgresql, both, or none). No counts, names or servers. | Once a day; processes that start at the same time may each send one. On by default; mcpbus telemetry off, MCPBUS_NO_TELEMETRY or DO_NOT_TRACK turns it off. |
The install ID is random and kept in install-id.txt; delete the file to get a new one. mcpbus telemetry show prints exactly what is sent. We store those three fields and the time — no IP address, user agent or location. Like any internet request, both calls pass through Cloudflare (and GitHub when it is the fallback), which can see your IP address.
Apart from these, mcpbus connects to your own SQL Server or PostgreSQL server and, if you use Microsoft Entra ID sign-in, to Microsoft to authenticate you.
Your AI assistant
mcpbus passes query results, schema and definitions to the AI assistant you connect it to. The assistant usually sends them on to its provider, such as Anthropic or GitHub, under the provider's terms. You decide what it sees through each database's level. With hashing on (the default), string and binary values in results become one-way tokens; definitions, schema and job steps are not hashed.
This website
mcpbus.sh is a static site on Cloudflare Pages and uses no cookies. Cloudflare Web Analytics counts page views in aggregate (page, referrer, browser and country) without cross-site tracking; according to Cloudflare it sets no cookies and does not store IP addresses or fingerprint visitors. To show the latest version number, your browser fetches it from GitHub's API. The download link points to GitHub.
Legal basis & storage
The update check, the usage count and the website statistics rest on our legitimate interest in knowing that mcpbus works and how it is used, so we can prioritise development and support (GDPR Art. 6(1)(f)). You can turn the usage count off at any time; the update check stays on so mcpbus can tell you about new versions.
We store the usage count in a Cloudflare D1 database and keep it for up to 13 months. Cloudflare and GitHub are US companies; transfers are covered by the EU–US Data Privacy Framework.
Your rights
You can ask to access, correct, export or delete your personal data, and you can object to processing. The usage count holds no name or contact details, only a random install ID, so include that ID (from mcpbus telemetry show) if you want its rows removed. Write to hello [at] mcpbus [dot] sh. You can also complain to the Swedish Authority for Privacy Protection (IMY).
Changes
When what mcpbus sends or stores changes, we update this page and the date at the top. See also Terms.