Privacy Policy — MCP Products Addendum
Contents
What MCP products are
NeuralConfig MCP products provide bridges between large-language-model agents (like Claude) and network-management platforms. To function, they sign in to your own network-management platform account on your behalf and run the operations you ask for through the agent.
Which servers this addendum covers
This addendum covers the following NeuralConfig MCP servers:
cp-mcp, at cp-mcp.lanpulse.comsz-mcp, at sz-mcp.lanpulse.com
It also covers any other NeuralConfig MCP server for which all four of the following are true:
- It connects an agent to a platform you already hold an account on, where your relationship with that platform exists independently of us.
- It authenticates using credentials you supply, which NeuralConfig stores on your behalf as described under Data collected.
- It reaches that platform only through the platform's own API, at an address you give us that is reachable from the public internet. It runs no software inside your network and does not connect to any other device on it.
- It relays what the platform returns to the requesting agent and keeps no copy of it. What it does keep is described under Retention.
An MCP server that fails any of these is not covered by this addendum. In particular, a server that runs software inside your own network, that reaches your devices directly rather than through a platform's API, or that stores what the platform returns, handles a different category of data and carries its own addendum. r1-mcp and Probe MCP each have their own:
If you are using a NeuralConfig MCP server and cannot tell which addendum applies to it, ask privacy@neuralconfig.com before you connect it.
The list above is illustrative, not limiting. The four conditions decide coverage: a server added later is covered when it meets them, whether or not this list has been updated.
Data collected
1. Account data
You sign in to an MCP product's dashboard with Google. We request the openid, email and profile scopes and store:
- Your email address (which Google must report as verified), your name and the address of your profile picture, as Google supplies them
- Your Google account identifier, so we can recognise you on your next sign-in
We do not receive your Google password, and we do not ask Google for access to any other Google service.
When you accept our Terms and Privacy Policy, we record which versions you accepted, when, and the IP address and browser user agent you accepted from. sz-mcp makes this record each time you sign in.
2. Platform credentials
To connect to your platform, you give us:
- The platform's address (host name, and port where the platform uses one)
- Your username and password for it
- Optionally, a label for the connection, and the platform's API version
Only the password is encrypted at rest. The address, username, label and API version are stored as plain text in our database, so that we can show them back to you.
When the MCP product signs in to your platform, the platform issues a short-lived session token. We cache that token, unencrypted, for up to 25 minutes, so that each request does not have to sign in again. It is deleted when it expires.
3. Platform data you request through the MCP
When you use the MCP to query your platform (for example, listing the access points it manages), the MCP retrieves data from the platform and relays it to the requesting agent. This data may include:
- Network device information (access points, switches, controllers)
- Configuration details
- Usage statistics
- Client device information (including potentially MAC addresses, usernames and session data, depending on the query)
This data is your data, stored in your platform account. The MCP relays it to the requesting agent and does not store it.
4. MCP tokens
When you connect an MCP client (such as Claude) to an MCP product, we issue it access and refresh tokens. Your dashboard session is also a token. We store every one of these only as an irreversible hash, never as the token itself, together with its expiry and when it was last used.
5. Usage data
For each tool call your agent makes, we record:
- The name of the tool called
- The time of the call
- Whether it succeeded or failed
- How long it took
We do not record the arguments or code your agent sent, which endpoint on your platform was called, or what the platform returned.
cp-mcp also offers an image-generation tool. For each image it records the model used, the processing time and whether it succeeded. It does not record the prompt.
6. Operational logs
Our servers log errors and operational events for debugging. These logs record status codes and error messages. They are not written to include your credentials or the data your platform returns. Our hosting provider, Cloudflare, also records a log of each request our servers handle, as described under Retention.
How MCP products use this data
- To run the operations you request
- To authenticate you, and to sign in to your platform on your behalf
- To debug errors and prevent abuse
MCP products are currently free.
MCP products do not access your platform for any purpose you did not ask for. They do not share your credentials or platform data with other NeuralConfig users, or with third parties other than those listed under Sharing.
Sharing
- Your platform: we send your requests to the network-management platform you connect, as you direct. That platform has its own privacy policy; review it.
- Your AI agent: what your platform returns is sent to the MCP client you connected, and so to the AI provider behind it (for example, Anthropic if you use Claude). You choose that agent, and its provider's terms govern what it does with the data. NeuralConfig does not send your data to an AI provider on your behalf.
- Cloudflare: our servers, database and logs run on Cloudflare. cp-mcp's image-generation tool sends your prompt to Cloudflare's Workers AI service to create the image.
- Google: for sign-in. The MCP products' dashboards also load fonts from Google, which exposes your IP address to Google when a page loads.
- No other third parties except as described in the Master Privacy Policy (legal process, for example).
Retention
- Account data: kept while your account exists. See Your rights for deletion.
- Platform credentials: kept until you delete them from your dashboard, which you can do at any time, or until your account is deleted.
- Platform session tokens: up to 25 minutes, as described under Data collected.
- Platform data you request: not stored.
- Usage data: deleted automatically after 90 days.
- Expired or revoked MCP tokens and sessions: deleted automatically 7 days after they expire or are revoked.
- Terms acceptance records, including the IP address and user agent: kept for as long as we may need to show what you agreed to and when. They are our legal record of your acceptance.
- Request logs: Cloudflare keeps the logs of requests to our servers for a limited period set by Cloudflare.
Security
- Your platform password is encrypted at rest with AES-256-GCM, using a key derived separately for each record.
- Your password is never returned by our API or shown in the dashboard after you save it.
- MCP tokens and sessions are stored only as hashes.
- Each account's data is separated by the application: every query is limited to the signed-in account.
- An MCP product only connects to platform addresses that are reachable from the public internet. It refuses private, local and loopback addresses.
You are responsible for keeping the tokens we issue to your MCP client secret. Treat them as passwords.
Your rights
- Delete your platform credentials: at any time, from your dashboard. This takes effect immediately.
- Sign out: ends your dashboard session immediately.
- Delete your account, export your data, or revoke your MCP tokens: email privacy@neuralconfig.com from the address you sign in with. There is no self-service control for these yet. We will act on your request within 30 days.
- Standard rights from the Master Privacy Policy (access, correction, and so on) apply where relevant.
Contact
← Back to the Master Privacy Policy