Skip to main content
At MCPcat, we take privacy and security seriously. We’ve built multiple layers of protection to ensure your users’ data remains secure and private throughout the entire analytics pipeline. MCPcat is co-founded by Naseem Al-Naji, creator of Opal, bringing years of experience in building privacy-first developer tools that handle sensitive data with the utmost care.

​
Client-Side Data Redaction

MCPcat provides powerful client-side redaction capabilities, allowing you to sanitize sensitive information before it ever leaves your environment. This ensures that sensitive data never reaches our servers.

​
How it works

You can provide a custom redaction function when initializing MCPcat tracking: 
import { mcpcat } from "@mcpcat/mcpcat-typescript-sdk";

mcpcat.track(mcpServer, "proj_YOUR_PROJECT_ID", {
  redactSensitiveInformation: async (text) => {
    // Redact email addresses
    if (text.includes("@")) {
      return "[REDACTED-EMAIL]";
    }

    // Redact credit card numbers
    if (/\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}/.test(text)) {
      return "[REDACTED-CC]";
    }

    // Redact API keys and secrets
    if (text.toLowerCase().includes("secret") || text.toLowerCase().includes("key")) {
      return "[REDACTED-SECRET]";
    }

    return text;
  }
});

​
Key Features

  • Recursive Application: Redaction is applied to all string values in event data, including nested objects and arrays
  • Protected Fields: Essential analytics fields (like sessionId, projectId, eventType) are preserved to maintain functionality
  • Type Preservation: Non-string values (numbers, booleans, dates) are preserved without modification
  • Error Handling: If redaction fails, the entire event is skipped to prevent accidental data leakage

​
Server-Side Privacy Protection

In addition to client-side redaction, MCPcat employs Microsoft Presidio on our servers to automatically detect and redact sensitive information that might have been missed by client-side filters.

​
Microsoft Presidio Integration

Our servers run every incoming event through a locally run Microsoft Presidio advanced PII detection engine, which identifies and redacts:
  • Personal Identifiers: Names, addresses, phone numbers, email addresses
  • Financial Information: Credit card numbers, bank account details, routing numbers
  • Government IDs: Social security numbers, passport numbers, driver’s license numbers
  • Medical Information: Patient IDs, medical record numbers
  • Custom Patterns: Domain-specific sensitive data based on your configuration

​
How it works

  1. Automatic Detection: Presidio analyzes all text fields in incoming events
  2. Context-Aware Redaction: Uses NLP to understand context and reduce false positives
  3. Configurable Sensitivity: Adjust detection thresholds based on your needs
  4. Audit Trail: Maintains logs of redaction actions for compliance purposes

​
Compliance & Certifications

MCPcat maintains the highest standards of security and compliance to protect your data.

​
SOC 2 Compliant

We undergo annual SOC 2 Type II audits, demonstrating our commitment to:
  • Security: Protecting data against unauthorized access
  • Availability: Ensuring systems are operational and accessible
  • Processing Integrity: Ensuring data processing is complete, valid, and authorized
  • Confidentiality: Protecting confidential information
  • Privacy: Collecting, using, and disclosing personal information in accordance with our privacy policy

​
Additional Security Measures

  • Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
  • Access Control: Role-based access control with principle of least privilege
  • Infrastructure Security: Hosted on SOC 2 compliant cloud providers
  • Regular Audits: Quarterly security assessments and annual penetration testing
  • Data Retention: Configurable retention policies with automatic data deletion

​
Disabling Telemetry

While MCPcat provides valuable analytics, we understand that some users may want to disable telemetry entirely. Since MCPcat doesn’t have a built-in disable flag, you can implement this in your MCP server by conditionally calling the track function.

​
Implementing Telemetry Control

Add environment variable support to your MCP server: 
import { track } from "@mcpcat";

// Check for telemetry opt-out
const telemetryEnabled = process.env.DISABLE_USER_ANALYTICS !== 'true';

// Only initialize tracking if telemetry is enabled
if (telemetryEnabled) {
  track(mcpServer, "proj_YOUR_PROJECT_ID");
}

​
Anonymizing User Sessions

For users who want analytics without user identification, implement anonymous mode: 
const anonymizeUsers = process.env.ANONYMIZE_SESSIONS === 'true';

// Override the identify function for anonymous mode
if (anonymizeUsers) {
  mcpcat.identify = async () => null;
}

​
Implementation Best Practices

  1. Document Environment Variables: Clearly document telemetry options in your MCP server’s README
  2. Default to Privacy: Consider making telemetry opt-in rather than opt-out
  3. Respect User Choice: Always check environment variables before initializing tracking
  4. Provide Granular Control: Allow users to disable specific types of tracking
Example implementation with multiple privacy options: 
const config = {
  telemetry: process.env.DISABLE_USER_ANALYTICS !== 'true',
  anonymize: process.env.ANONYMIZE_SESSIONS === 'true'
};

// Initialize MCPcat based on user preferences
if (config.telemetry) {
  const options: any = {};

  if (config.anonymize) {
    // Override identify to prevent user tracking
    options.identify = async () => null;
  }

  mcpcat.track(mcpServer, "proj_YOUR_PROJECT_ID", options);
}