McClipFaceAdd McClipFace

Security & controls

This page describes how McClipFace's MCP server (https://mcclipface.com/mcp) is designed to be used, and which controls exist outside the MCP tool list. Directories that read only tools/list cannot see most of these, because the MCP specification has no field for them.

McClipFace is a free coupon and deals lookup for AI assistants, operated by GetClippy LLC. Coupon lookups work without an account.

What the tools do

The live server (4.0.0) lists six tools. find_coupons, find_product_coupons, discover_deals and get_guide only read public coupon, deal and help data. wrap_link and report_coupon_result don't change anything you can see:

  • wrap_link builds a shopping link (and a short link). When we don't earn from that store yet, it notes the page address (no query string, nothing about the shopper) for 90 days so we can set that store up.
  • report_coupon_result records an anonymous worked-or-failed result for a code or deal, with an optional short reason (up to 200 characters). It doesn't place orders or change any account. Assistants are instructed to send reports only when the shopper has turned on Community mode, which is off by default; the server itself can't check that setting.

Coupon tools need no sign-in, because the data is a public catalogue, so don't send them anything private.

Turning McClipFace off

  • Remove or disconnect the McClipFace connector or plugin in your assistant's settings.
  • If your assistant saved a clippy-mc-clipface folder with SKILL.md, delete it or ask the assistant to remove it.
  • To stop sharing results only, say "Turn off McClipFace Community mode." Lookups still work.
  • Tell the assistant you don't want coupon checks and to forget saved McClipFace preferences.

These steps stop that assistant from calling us. Because coupon lookups use no access token, there is no credential to revoke or expire on our side, and the public endpoint stays available to other callers.

Rate limits

  • MCP: 300 requests a minute per client IP and 3,000 a minute across all clients. Over the limit the server returns HTTP 429 with Retry-After. The counter is a one-way hash of the IP and the minute that expires after two minutes. If the limit store is briefly unreachable, requests are allowed.
  • Reports: at most 30 stored per hour per client (broken-link reports 10 per hour), and at most one counted per client per store and code in 24 hours; repeats are stored but not counted.

What we record, and for how long

  • We keep no per-person shopping history. We keep aggregate counts, a 30-day log of each lookup's tool, assistant type, result and matched store, and the search words for 7 days. Unmatched search terms and store domains are kept as daily counts. None of these carry an IP address, user agent or install ID.
  • Install ID: the raw ID is never stored; only a hash salted with a monthly key is kept, and it becomes unreadable once that month's salt is deleted. It isn't linked to stores, codes or reports.
  • Coupon reports are deleted after 90 days. They hold the store, code or deal, outcome, optional reason and related technical fields, with no IP, user agent, account or cart. Counted reports for codes not in our catalogue keep a pseudonymous reporter hash (made from a hashed IP plus the store and code) for the same 90 days. Test requests are never stored.
  • Our hosting provider (Vercel) keeps request logs, including the requested address with its query string and the user agent, for about 30 days under our plan.

We don't offer a personal, customer-readable audit log of tool calls, because coupon lookups have no accounts. Privacy requests: hello@mcclipface.com.

Independent assessments

Both describe registry version 1.3.0; the live server is 4.0.0.