Privacy, browser storage and Trust Scan

Local processing by default

Uploading a local file or pasting a specification does not send that specification to the mcpmint server. Parsing, normalization, preview and ZIP generation run in a dedicated browser worker. Browser generation is enabled by default on Export.

URL import sends the URL you enter to /api/fetch-spec, which retrieves the public document using bounded, SSRF-protected requests. Disabling browser generation sends the configured API model and selected tools to /api/generate. These are explicit network paths, not private-mode parsing.

External schema references are not fetched automatically. Bundle them locally before import. The website also loads its font stylesheet and aggregate Vercel analytics; local processing refers to the specification workflow, not an entirely offline website.

Saved work stays in this browser

Working sessions and named projects use IndexedDB on the current site origin. Existing localStorage projects migrate when loaded. This is local browser storage, not account synchronization or encrypted cloud backup. Browser settings, private browsing, device cleanup or a domain change can remove or separate it.

Export a portable project file for a backup or to move work between browsers. Project files contain the API model and tool configuration, including examples and descriptions: treat them as sensitive if the original specification is sensitive. A visible storage error means you should keep the tab open and export before leaving.

Configure credentials locally through the generated environment template or MCP client. The browser sandbox inspects requests and runs mocks without accepting or sending upstream credentials.

What the Trust Scan establishes

The Trust Scan checks tool descriptions and schemas for suspicious instructions, parameters, broad permissions and risky combinations. Its findings are heuristics. It cannot prove that an API is safe, that documentation is truthful, or that generated code has no vulnerabilities.

Read red and yellow findings, inspect the exported source and use the least privilege appropriate for your upstream. A downloaded attestation records the scan and a digest of the inspected tool definitions; it is not a security certification.