Terms of Use
Effective September 16, 2026
1. Acceptance
By accessing or using AlltoMCP (the “Service”), you agree to these Terms. If you use the Service for an organization, you represent that you may bind that organization. Do not use the Service if you do not agree.
2. The Service
The Service converts OpenAPI definitions, manually configured REST endpoints, and GraphQL operations into MCP tools. It may store connector configuration and credentials and send requests to third-party APIs when an authorized MCP client invokes a tool. The Service is an integration layer; it does not own, control, or verify third-party APIs or their output.
3. Accounts and security
You are responsible for accurate account information, protecting passwords, MCP tokens, upstream credentials, and connected client accounts, and for all activity performed through your account. Notify the Operator promptly if you suspect unauthorized access.
4. Your APIs, data, and instructions
You retain responsibility for contracts, schemas, queries, credentials, tool descriptions, and other material you submit. You represent that you have all permissions needed to access each connected API and process the data involved. You must review generated tools and test their behavior before allowing agents or other users to invoke them.
5. User responsibility
You are solely responsible for choosing exposed endpoints, granting access, configuring authentication, validating requests and responses, monitoring use, backing up data, and complying with contracts, licenses, privacy rules, and other laws that apply to you. You accept the risks of automated or model-initiated actions, including incorrect, destructive, duplicated, delayed, or unauthorized upstream operations.
6. Acceptable use
You may not use the Service to access systems without authorization; violate law or third-party rights; distribute malware; bypass security controls or usage limits; interfere with the Service; expose secrets or personal data unlawfully; or create tools intended to facilitate fraud, abuse, or harm.
7. Third-party services
Third-party APIs, MCP clients, hosting providers, and AI services have their own terms and privacy practices. The Operator is not responsible for their availability, security, content, decisions, rate limits, or changes. Your use of those services is governed by your agreements with them.
8. No warranties
To the maximum extent permitted by applicable law, the Service is provided “as is” and “as available,” without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, accuracy, security, availability, or that generated tools will be error-free. The Service is not a substitute for security, legal, compliance, or professional review.
9. Limitation of liability
To the maximum extent permitted by applicable law, the Operator and its contributors will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages; lost profits, revenue, data, goodwill, or business; third-party API charges; credential misuse; or actions taken through generated tools. Where liability cannot be excluded, the Operator’s aggregate liability will not exceed the fees you paid for the Service during the twelve months before the event giving rise to the claim.
10. Indemnity
To the extent permitted by law, you will defend, indemnify, and hold harmless the Operator and its contributors from claims, losses, liabilities, and reasonable costs arising from your APIs, data, credentials, tool configuration, use of the Service, violation of these Terms, or infringement of another person’s rights.
11. Suspension and termination
The Operator may suspend or terminate access when reasonably necessary to protect the Service, users, or third parties; respond to legal requirements; or address a material breach. You may stop using the Service at any time and delete connectors from the workspace.
12. Changes and governing terms
The Operator may update these Terms and should publish a new effective date. Applicable law and venue are those specified by the Operator for this deployment. Mandatory rights under applicable law remain unaffected.
13. Contact
Questions, notices, and rights requests should be sent using the contact method published by the Operator of this deployment.