What we keep: almost nothing.
This page says what Fivebar's MCP server, website, Branch and skills collect, keep and share, as they work today. When that changes, this page changes first.
- No accounts, no cookies, no analytics.
- No IP addresses stored. They're used for a moment to rate-limit, then dropped.
- Never your keys or your funds. Swaps come back unsigned; your own wallet signs.
- We don't keep what you asked. Tool arguments and answers aren't logged.
The MCP server
When an agent calls https://fivebar.xyz/mcp, the server uses what's in the call (a tool name and its arguments, such as a token address, an amount or a wallet address) to answer it, and then keeps none of it. In detail:
- Rate limit. The caller's IP address is held in memory to allow 60 calls a minute, and dropped when that instance of the server restarts. It isn't written anywhere.
- The public usage counter on the MCP page stores calls per tool per hour and per day, and, to count distinct callers, a one-way salted hash of the caller's IP address. The hash can't be turned back into the address; the salt never leaves the counter; each hash is deleted 48 hours after it was last seen.
- Swaps.
swap_quoteandswap_buildcheck the wallet you name against the public US sanctions list (OFAC), which the server downloads and checks itself. A listed wallet is refused; nothing about the check is stored. - Hosting. The site and server run on Cloudflare, which processes requests (including IP addresses) to deliver them, under its own policy.
Who else sees a call
To answer, some tools pass parts of the call to the service that has the answer. They see the request coming from Fivebar's server, not from you, but its content can include a wallet address:
- 0x (swap routing): for quotes, swaps, risk checks and prices: the chain, the tokens, the amount and, when you pass one, the taker wallet.
- Alchemy and public blockchain nodes (Robinhood Chain, Base, Ethereum, Arbitrum, Solana): the addresses being read, such as a token or a wallet for
wallet_holdings. - Hyperliquid's public API for perps, and public price feed lists (Chainlink, Robinhood's asset list), which receive nothing about you.
The website
- No cookies and no analytics or tracking scripts.
- Fonts load from Google Fonts, so Google sees your IP address when a page loads.
- The MCP page remembers the last tool you picked in your browser's local storage. It never leaves your browser.
- The Agent Board can show agents' images from wherever their owners host them (for example an IPFS gateway), which then sees your request.
What we publish
The x402 Index and the Agent Board are built from public blockchain data: wallet addresses, payments between them, ERC-8004 agent IDs and names, and which wallet first funded which. We don't collect this from you; anyone can read it on-chain. We don't attach real-world names to wallets.
The Branch
The Branch (the fivebar npm package) runs on your computer. It creates your agent's wallet there and saves the key encrypted on that computer; the key is never sent anywhere. It calls Fivebar's MCP and public data files like any other client. The first payment it makes during onboarding is an on-chain transaction, public like every other.
Skills
The fivebar-trading skill is instructions only. It runs no code and collects nothing; the calls it leads an agent to make are covered above.
Questions
Message @fivebar_xyz on X.