What a transit request includes
Your MCP client sends Metro MCP a request body with a tool name and the public transit arguments needed to answer it. Depending on the tool, those inputs can include a city, station name or code, route or line identifier, stop identifier, or a location and search radius. The Worker processes request bodies and public transit arguments only to answer the request.
Metro MCP sends the necessary transit inputs to WMATA for DC requests and MTA for NYC requests through server-to-server requests. It does not forward your IP address or conversation to either transit provider. It returns the resulting public transit information to your client. Do not include secrets or unrelated personal information in transit inputs.
No account or credential collection
Metro MCP 6.0 does not require accounts and does not intentionally collect GitHub identity, OAuth grants, access tokens, refresh tokens, client registrations, cookies, or browser storage.
If a client still sends an old bearer credential, the Worker removes the Authorization header before dispatch. Metro MCP does not use it to identify you or grant access.
Metro-owned telemetry is allowlisted
Metro MCP writes allowlisted operational telemetry rather than copying arbitrary request data into its own records. The possible fields are a correlation identifier, protocol era and version, MCP method and tool name, endpoint alias, upstream name, request duration, and response status class.
The Metro-owned allowlist has no client identity field. It excludes request bodies, transit input values, raw errors, secrets, and full responses. Invalid and unknown fields are dropped before the record is serialized.
Short-lived station-selection state
When a station name is ambiguous, a client-held signed request state can persist for up to five minutes. It contains only public station-selection fields: the tool, city, normalized query, and offered station IDs. It creates no server-side account or session.
Edge and provider logs
Cloudflare necessarily processes network metadata such as your IP address. Cloudflare platform and invocation logs may exist under the service operator’s Cloudflare configuration. Sampled Worker logs and traces contain only Metro MCP’s allowlisted operational telemetry fields. Their contents and retention depend on Cloudflare and the active configuration; Metro MCP does not promise a retention period it cannot enforce.
WMATA and MTA may also keep access or service logs when they receive upstream requests. Cloudflare and upstream provider logs and policies are outside Metro MCP’s direct control.
Independent services and clients
Third-party processing is subject to the policies of Cloudflare, GitHub hosting, WMATA, MTA, and your MCP client’s policies as applicable. Claude, OpenAI, Codex, and other clients are independent services with their own policies; this page describes only the Metro MCP operator’s practices.
What Metro MCP does not do
- Metro MCP does not sell personal information.
- There is no advertising on the service.
- Request data is not used for model training by the Metro MCP operator.
- Metro MCP does not track you across websites or apps.
- These legal pages do not run scripts, set cookies, or use browser storage.
Stop processing, questions, or concerns
You can stop Metro MCP processing by disconnecting the service or ceasing requests. Because the service has no user accounts, there is no account profile to retrieve or delete.
For help, a privacy question, or the current security report route, visit Metro MCP Support.