← X190

Terms, refunds and privacy

X190 is operated by unempyd. These terms cover the paid engagement. The tool itself is free under the MIT licence and nothing here restricts your use of it.

Last updated 12 September 2026.

What you are buying

Endpoint review — US$2,500, fixed. We probe up to 25 MCP endpoints you nominate, then manually examine the things the probe deliberately refuses to conclude: whether a token is actually validated rather than merely required, whether authorisation is enforced per tool, whether a session identifier is bound to the authenticated principal, and whether an open tool surface is intentional. You receive written findings, with specific remediation for each, within five business days of scope being agreed.

Continuous watch is withdrawn as of 12 September 2026 and is no longer sold. Our own measurement of the population found the fleet operator it was priced for does not meaningfully exist. Nobody was subscribed when it was withdrawn, so no existing customer is affected. If you run enough endpoints that checking them by hand is a real problem, ask and we will scope it.

Authorisation — the part that matters

You must own the endpoints you nominate, or hold documented authorisation from whoever does. By purchasing you confirm this. We will ask you to state it in writing before any probe runs, and we will not probe an endpoint you cannot account for.

This is not a formality. A probe is a request to somebody's live server, and sending one to a system you are not entitled to test is your liability, not ours.

What we do not claim

  • Receipts are not attestation. They are HMAC-signed, which is symmetric: anyone who can verify one can mint one. They are tamper evidence for your own archive. We do not sell third-party attestation and cannot, and you should treat anyone who offers it on this basis with suspicion.
  • A review is a point in time, from one network position. An endpoint can return a clean refusal to a known reviewer and its tool list to everyone else. We reproduce this in our own testing; it is inherent to remote black-box probing.
  • Posture decays. One measurement found 41.6% of listed servers gone within three days. A passing result today says nothing about next month.
  • A review is not a penetration test and not a compliance certification. It answers a narrow question thoroughly rather than a broad one shallowly.

Refunds

Endpoint review. Refunded in full, no questions, any time before we begin work. Once written findings have been delivered they are bespoke work product and are not refundable. If we fail to deliver within five business days of scope being agreed, and the delay is ours, you get a full refund and the findings anyway.

Continuous watch. Withdrawn and not sold. Had anyone been subscribed, the terms were: cancel any time, no pro-rating of partial months, and a full month refunded if the daily probe missed more than three consecutive days for reasons within our control. Recorded here rather than deleted.

To cancel or request a refund, open an engagement issue or reply to your Stripe receipt. We aim to respond within one business day.

Confidentiality

We never publish findings that name your systems. Not in our repositories, not in aggregate write-ups, not as a case study without your written permission. Where we publish population statistics, they are aggregate rates only and no endpoint is identified.

If we find something serious that affects a third party, we handle it as a private disclosure with that operator. We do not publish it and we do not use it as a sales approach.

Privacy

We collect as little as the work allows.

  • Payment. Handled entirely by Stripe. We never see or store your card details. Stripe provides us your email address and name so we can deliver what you bought. See Stripe's privacy policy.
  • Endpoint lists. Provided by you privately after purchase, never on the payment page. Kept for the duration of the engagement and deleted on request.
  • Probe results. Stored privately so history can be shown to you, and deleted on request.
  • The website. Static, served by GitHub Pages. No analytics, no tracking pixels, no advertising cookies. GitHub records server logs; see GitHub's privacy statement.

We do not sell, rent or share your data. Ask us to delete anything we hold about you and we will, except where we are required to retain billing records.

Liability

Our total liability for any engagement is limited to the amount you paid for it. We are not liable for indirect or consequential loss. Nothing here excludes liability that cannot lawfully be excluded.

Contact

unempyd — open an issue. For anything that should not be public, use a private security advisory.