tabnas

Privacy

This covers the hosted MCP endpoint at mcp.tabnas.dev. It is the only tabnas service that receives your data at all.

The short version

Document content is never logged, never stored, and never used for training. The endpoint parses what you send, returns the answer, and keeps nothing. There is no database, no object store and no session — every request is self-contained, which is what makes that promise cheap to keep rather than a matter of trust.

If that is not enough for you, run it locally. It is the same code with the same answers, and the recommended path regardless: 

npx --yes @tabnas/mcp mcp

Locally there is no network hop, no operator, and nothing on this page applies.

What is recorded

Shape only, per request, for keeping the service working:

  • Tool name — e.g. parse.
  • A size bucket — one of <=1k, <=16k, <=64k, <=256k. Deliberately a bucket and never a byte count: an exact document length is a weak fingerprint of the document, and this service does not hold facts about content.
  • Duration in milliseconds.
  • Status and error code — whether the tool answered yes or no, and which documented code it returned.

That list is exhaustive. It is defined in one place — Telemetry in ts/src/budget.ts — and the test suite asserts a parsed secret does not appear in an emitted record.

What is never recorded

  • The documents, grammars, fixtures or options you send.
  • The trees, diagnostics or reports returned to you.
  • Any byte of request or response body, in any form.

No content is used to train anything, by us or by anyone else. There is no mechanism by which it could be: it is not retained long enough to be collected.

What Cloudflare sees

The endpoint runs on Cloudflare Workers, so Cloudflare operates the network path and applies its own standard protections. Being the network, it necessarily handles your request in transit and sees the connecting IP address. Per-IP rate limiting uses that address to count requests; the count is what is kept, not a log of who you are.

This is the unavoidable cost of a hosted endpoint, and the reason local stdio is the recommended path rather than a fallback.

The website

tabnas.dev is a static site. No analytics, no tracking pixels, no advertising, no cookies set by us. Search runs entirely in your browser.

Changes

This page is version-controlled with the code it describes, in the tabnas repositories. A change to what the service records is a change to this page in the same commit — the history is the changelog.