Plugin telemetry and privacy

What the install signal collects

The payload is exactly two fields:

• plugin — the plugin name, e.g. finance-mcp. Validated against a 25-plugin allowlist on the server.
• version — the plugin version, e.g. 0.1.0.

That is the entire body. No email, no machine name, no user ID, no config, no file contents, no message contents, no project paths.

What the server side records

When the POST arrives, the server hashes the source IP (sha256 with a server-side salt, truncated to 24 hex characters) so the same machine installing the same plugin twice on the same day only fires one Slack ping. The hashed value is used as an idempotency key and a rate-limit bucket only.

• The raw IP is never stored.
• The hashed IP is stored in a 24-hour-expiring Redis sentinel keyed to the (plugin, day, hash) tuple.
• The endpoint always returns 204. Plugin install must not break if our endpoint is down.

What the install signal does NOT collect

• No email address, no name, no account identifier, no GitHub login.
• No machine name, no OS version, no shell, no hostname, no MAC address.
• No file paths, no project directories, no repository URLs.
• No file contents, no message contents, no Claude conversation context.
• No environment variables, no config values, no credentials.
• No persistent device identifier. The hashed IP is salted and ephemeral.
• No third-party analytics, no cookies, no ad pixels.

How to opt out

Set the environment variable MYCELIUM_NO_PING=1 in your shell before installing any plugin. The hook reads this variable on every run and exits immediately if it is set to any non-empty value. No request is sent.

# bash / zsh
export MYCELIUM_NO_PING=1

# fish
set -x MYCELIUM_NO_PING 1

You can also block the request at the network layer (firewall rule on mycelium-ai.co) or audit the hook source itself before installing.

Why we ping at all

We are an independent shop maintaining 25 plugins for free. The install ping is the minimum-viable signal that tells us which plugins are actually getting used so we know where to spend maintenance time. It does not feed a marketing funnel, it does not get re-sold to a data broker, and there is no user identity attached to it.

If you want to support the project without sending the ping, install with MYCELIUM_NO_PING=1 and star the repos on GitHub instead. Both signals are equally useful to us.

Source code

The install hook is open-source and identical across every plugin. Read it at:

github.com/adelaidasofia/finance-mcp/blob/main/hooks/install-ping.py

The server endpoint that receives the ping lives at github.com/adelaidasofia/mycelium-site/blob/main/src/app/api/install/route.ts.

Changes and questions

If this policy changes, the “Last updated” date at the top of this page changes too. Questions: write us at contact@mycelium-ai.co or open an issue on any of the plugin repos.

← Back to all plugins