Plugin telemetry and privacy
Last updated: 2026-05-13
Every plugin under github.com/adelaidasofia ships a single install-signal hook. When you install a plugin for the first time, the hook sends one HTTP POST to https://mycelium-ai.co/api/install. This page documents exactly what travels over that wire, what does not, and how to turn it off.
What the install signal collects
The payload is exactly two fields:
plugin— the plugin name, e.g.finance-mcp. Validated against a 25-plugin allowlist on the server.version— the plugin version, e.g.0.1.0.
That is the entire body. No email, no machine name, no user ID, no config, no file contents, no message contents, no project paths.
What the server side records
When the POST arrives, the server hashes the source IP (sha256 with a server-side salt, truncated to 24 hex characters) so the same machine installing the same plugin twice on the same day only fires one Slack ping. The hashed value is used as an idempotency key and a rate-limit bucket only.
- The raw IP is never stored.
- The hashed IP is stored in a 24-hour-expiring Redis sentinel keyed to the (plugin, day, hash) tuple.
- The endpoint always returns 204. Plugin install must not break if our endpoint is down.
What the install signal does NOT collect
- No email address, no name, no account identifier, no GitHub login.
- No machine name, no OS version, no shell, no hostname, no MAC address.
- No file paths, no project directories, no repository URLs.
- No file contents, no message contents, no Claude conversation context.
- No environment variables, no config values, no credentials.
- No persistent device identifier. The hashed IP is salted and ephemeral.
- No third-party analytics, no cookies, no ad pixels.
How to opt out
Set the environment variable MYCELIUM_NO_PING=1 in your shell before installing any plugin. The hook reads this variable on every run and exits immediately if it is set to any non-empty value. No request is sent.
# bash / zsh export MYCELIUM_NO_PING=1 # fish set -x MYCELIUM_NO_PING 1
You can also block the request at the network layer (firewall rule on mycelium-ai.co) or audit the hook source itself before installing.
Why we ping at all
We are an independent shop maintaining 25 plugins for free. The install ping is the minimum-viable signal that tells us which plugins are actually getting used so we know where to spend maintenance time. It does not feed a marketing funnel, it does not get re-sold to a data broker, and there is no user identity attached to it.
If you want to support the project without sending the ping, install with MYCELIUM_NO_PING=1 and star the repos on GitHub instead. Both signals are equally useful to us.
Source code
The install hook is open-source and identical across every plugin. Read it at:
github.com/adelaidasofia/finance-mcp/blob/main/hooks/install-ping.py
The server endpoint that receives the ping lives at github.com/adelaidasofia/mycelium-site/blob/main/src/app/api/install/route.ts.
Changes and questions
If this policy changes, the “Last updated” date at the top of this page changes too. Questions: write us at contact@mycelium-ai.co or open an issue on any of the plugin repos.
Mycelium · founded 2026