Privacy

Updated 21 October 2026.

Your sign-in stays in Chrome

Site MCP never reads, stores or sends a password, token or cookie. A tool calls the site from your browser, and Chrome attaches the site's cookie itself. A site is reachable only while you have it turned on.

What the extension keeps, in your browser only

• Its signing key, which connects it to the relay. It never leaves the extension.
• The GitHub username you entered, which is the only account allowed to call it.
• Which sites are on and pinned.
• Your last 200 tool calls, shown in its side panel, so you can see what was done in your name.

What passes through the relay

Your AI app reaches the extension through an MCP relay at relay.site-mcp.com, run by the maintainer on Cloudflare. Tool calls and their results pass through it and are not stored. The relay keeps:

• The extension's list of tools, until 30 days after the extension last connects.
• One log line per call: the GitHub account that called, the tool's name, the AI app, the country, whether it succeeded, and how long it took. It never logs what was sent or returned, the extension's key or its connector address.

What goes to your AI app

Whatever a tool returns goes to the AI app that called it (for example claude.ai), under that app's own privacy terms.

Contact

Report a problem privately through GitHub's private vulnerability reporting.