Last updated 2026-08-31. Plain-language, and accurate to what the code actually does — not aspirational.
This describes what Agent Capability Search ("we," "the service") actually collects, stores, and does with data, as of the date above. It's written to match the real, current implementation, not a general template — if something below stops being true as the product changes, this page gets updated, not left stale.
| Data | Why | Retention |
|---|---|---|
| Email address (at signup) | Account identity, tied to your API key(s) | Until you ask us to delete your account (see below) |
| API keys | Authentication | We store a one-way hash only — never the raw key, never recoverable by us |
| Usage counts (search/resolve call counts, timestamps) | Rate limiting, billing for paid tiers | Tied to account lifetime — we do not store the content of your queries or the capabilities you resolved, only that a call of a given type happened, and when |
| A hash of your IP address (anonymous search and signup only) | Abuse prevention — a small per-IP daily limit on unauthenticated requests. We hash it before it's ever written to our database; the raw address is never stored | Rolling, bucketed by day |
| Provider contact info (if you claim/verify a listing) | To confirm and communicate about a capability listing you own | Until you ask us to remove it |
/resolve responses beyond the fact that a call happened.The core of this service is an index of publicly available AI-agent capabilities (MCP tools, A2A skills, REST APIs) discovered from public sources (registries, public GitHub repositories, public API directories). Before anything from a crawled source is stored, it's scanned to strip anything that looks like a real credential or secret — if you're a provider and believe something of yours was indexed in error or contains information it shouldn't, contact us (below) and we'll investigate and remove it.
You can ask us to delete your account and associated data at any time — contact us using the address below. We'll remove your email, revoke your API keys, and delete your usage history. Aggregate, de-identified usage statistics that can't be tied back to you may be retained.
If this changes in a way that affects what we collect or how we use it, we'll update the date at the top of this page. We don't currently have a notification mechanism for policy changes beyond that — check back if you're relying on a specific version of this policy.
Note: this page describes our actual current data practices in plain language but has not yet been reviewed by a lawyer. It's a good-faith, accurate description, not a substitute for legal advice — treat it as informative rather than a fully vetted legal document until that review happens.