MCP Platform
Security
Where your API key lives, and exactly what Claude can see.
The MCP server is a local process running on your own computer — it is not a cloud service.
What lives where
| What | Where | Who can see it |
|---|---|---|
| Your API key | .env or the Claude config file on your machine | Only you |
| MCP server | A local process on your machine | Only you |
| SEO data | Sent from the Semust API to Claude via MCP | You and Claude |
| Your API key | Never sent to Claude or Anthropic | No one else |
Built-in protections
- The API key is only used for requests going from your machine to
api.semust.com. - The server refuses to start if
SEMUST_BASE_URLishttp://(non-localhost) — your key is never sent in plaintext. - The
.envfile is in.gitignore, so it will not be committed by accident. - Every tool is read-only; none of them modify data.
Protect your config file
Anyone who can read your Claude Desktop config file can also read your API key.
Third-party content
SEO data passed to Claude is treated as user-trusted content. If your Search Console contains spam queries with embedded instructions, the model may act on them — this is inherent to any MCP tool that surfaces third-party data.
Last updated: 2026-08-21