Exactlane / Preflight evidence

Privacy policy

Updated 2026-09-11

This policy describes how the Exactlane Preflight service at https://exactlane.dev handles information. It documents implemented behavior only. It is not a GDPR, CCPA, SOC, ISO, or other regulatory certification.

What Exactlane is

Exactlane provides bounded static compatibility evidence for a caller-supplied MCP capability snapshot against caller-stated workflow requirements. Exactlane does not probe live endpoints and does not certify security, full MCP conformance, provider trust, live availability, payment success, or business-result correctness. The caller owns CONTINUE / UPDATE_INTEGRATION / HOLD.

No signup

Public Agent Preview does not require an account, signup, email address, or human approval. Human pages do not use JavaScript, analytics, advertising cookies, or third-party fonts.

Information processed

When Public Agent Preview, the REST API, or the remote MCP adapter is used, Exactlane may store:

• an optional display_label supplied with a grant
• caller-provided capability snapshots and workflow requirements
• finished check reports and owner-private report artifacts
• optional usage-event attestations: opaque integration and workflow references, trigger, decision (CONTINUE / UPDATE_INTEGRATION / HOLD), boolean flags, and occurred_at
• a SHA-256 digest of bearer credentials (hex digest of the UTF-8 token bytes). The plaintext bearer is not retained at rest.
• a SHA-256 client_hash of the request client identity when one is available, taken from CF-Connecting-IP, else the first X-Forwarded-For hop, else the peer address. This value is used only for issuance abuse control. It is not sold and is not labeled anonymous.
• issuance timestamps used for rate-limit and quota accounting
• idempotency records (route, request digest, and a redacted stored response) for 24 hours

HTTP logs record request ID, method, path, status, and duration. Logs exclude Authorization headers, request bodies, snapshots, requirements, and credentials.

Public Agent Preview grants

Verified from the running service constants:

• lifetime: 1800 seconds (30 minutes)
• scopes (PUBLIC_PREVIEW_SCOPES): capabilities:write, capabilities:read, checks:write, checks:read, usage:write, self:delete. Preview grants do not receive bootstrap administrator scope.
• quotas per grant: capabilities 2, checks 3, usage_events 2
• issuance rate limits: 5 grants per client_hash per hour; 20 grants per hour globally; 100 grants per UTC day
• the bearer is disclosed only on the original HTTP 201; exact Idempotency-Key replay returns 200 without the token
• disabled deployments return 403 PUBLIC_ACCESS_DISABLED

Remote MCP

The Streamable HTTP adapter at https://exactlane.dev/mcp (tool check_mcp_capability) creates an internal Public Agent Preview grant, keeps the bearer inside the process, and revokes it in a finally block. MCP tool output is guarded so it does not include that bearer. The same grant quotas and issuance rate limits apply because the adapter uses the existing grant path.

Retention

• capability revisions and check artifacts expire after about 30 days
• usage events expire after about 45 days
• usage occurred_at must fall within a 45-day window and not more than five minutes in the future
• idempotency records expire after 24 hours
• expired private artifacts and rows are deleted during startup/maintenance cleanup

What Exactlane does not do

• no live probing and no fetching of caller-supplied URLs
• no sale of user data
• no public sharing endpoint for reports in this implementation

Infrastructure

When the hosted origin is reached through the current public deployment, Cloudflare may process connection metadata, including IP addresses, as edge, DNS, or tunnel infrastructure. GitHub hosts the public discovery repository used for support issues; this service does not publish Preview snapshots or report artifacts there. Exactlane is listed on the Official MCP Registry as dev.exactlane/preflight (remote URL https://exactlane.dev/mcp). The Registry is a public discovery catalog; tool invocations still hit Exactlane’s own hosted service. Registry listing does not receive Preview bearers, capability snapshots, or check reports from Exactlane tool calls.

Contact

See /support.