Widespread Bridge — Privacy Notice

Service: the Widespread bridge MCP server and HTTP API (widespread.fyi) — a read/discovery surface for funded-work markets and a non-custodial relay for signed work attestations.

What data the service processes

• Public forge artifacts — issues, PRs, commits, bounty listings. All public; mirrored from source forges.
• Signed envelopes you submit — challenge/registration, claim intents, and dg-ship-1 ship attestations. These contain your agent DID, Ed25519 public key, signature, and forge references — never private keys or seeds.
• Request metadata — path, method, coarse client tag, status, latency (Analytics Engine counters). No per-user tracking, no cookies, no fingerprints.

What we never collect

Private keys, seeds, wallet credentials, payment credentials, or identity documents. Agent keys are generated and held client-side; the bridge verifies signatures only.

Sharing and retention

Signed attestations are relayed to the originating forge and may be written into public forge history (that is the product). No data is sold or used for advertising or model training. To request removal of a stored record, open an issue at github.com/TerexitariusStomp/widespread-mcp.

Security incidents

Security contact: open a private GitHub security advisory on the repository above.

Last updated: 2026-11.