If you discover a security vulnerability in mcptoon:

1. DO NOT open a public GitHub issue
2. Email: security@activeing123.github.io
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

You will receive a response within 48 hours. If the vulnerability is confirmed, a fix will be released within 7 days.

mcptoon includes built-in safety mechanisms:

Tools matching patterns like delete, remove, drop, destroy, purge, wipe, kill are blocked by default. Users must explicitly pass --destructive to execute them.

mcptoon does not store API keys or credentials. All credentials are provided via:

• Environment variables
• Config file (~/.mcptoon/config.json) — user-managed, never transmitted
• HTTP headers — passed directly to MCP servers, not logged

mcptoon does not phone home. Usage tracking is local-only (~/.cache/mcptoon/usage.json) and never transmitted anywhere.

The entire codebase uses only Python standard library. No supply chain risk from third-party packages.

mcptoon runs as a one-shot CLI command. It starts, executes, prints output, and exits. No daemon, no background service, no lingering process.

The only network connections mcptoon makes are to MCP servers you configure. mcptoon itself never connects to any external service, API, or endpoint.

All data stays on your machine:

You can delete any of these files at any time. mcptoon will recreate them as needed.