UND Assay — Terms of Service Addendum
1. Relationship to the UND Terms of Use
This Addendum adds to the UND Industries Terms of Use at undindustries.com/terms (the "Main Terms"). The Main Terms apply to UND Assay at undassay.com as a UND service, as if undassay.com were named in them. If this Addendum and the Main Terms conflict about UND Assay, this Addendum controls. Everything not covered here is governed by the Main Terms. Section 20 of this Addendum states the governing law and how disputes are handled, so those terms stay in force for UND Assay even if the Main Terms cannot be reached. Earlier versions of this Addendum are kept at undassay.com/legal.html (Earlier versions).
2. What UND Assay is
UND Assay is a registry of software tools, such as MCP servers, APIs and Claude Code plugins. For each tool we publish statements about publisher identity, provenance, source, maintenance, known vulnerabilities and changes between versions, and we link each statement to the evidence it is based on.
2.1 Some tools are listed but not analyzed. Their pages say so. A listed-only page shows information from a public catalog or registry and names that source; where the source's licence does not allow us to copy its description, the page shows only facts such as the tool's name, owner and link. A listed-only page is not a statement by us that the tool was checked.
2.2 We do not host the tools we list. To record what a tool does, we may install and start it in a separate, temporary test machine that gives it no real credentials and has no access to our internal systems or to yours; what we record there is evidence of what it did in that test, not a guarantee of what it will do on your systems. A tool, plugin or hook you install runs on your own systems under your own permissions (Section 3.7).
2.3 Names of other companies' products, such as Claude and Claude Code, are used only to say what a tool works with. Listing a tool is not an endorsement by that company or by us (Section 16).
3. What our statements mean, and what they do not mean
3.1 Each statement has one of five states: Verified, Claimed, Contradicted, Stale or Unknown. The definitions are published in the Methodology and are part of this Addendum.
3.2 "Verified" refers to the specific statement it is attached to. "Verified publisher" means identity only: who published the tool.
3.3 We do not certify that any tool is safe, secure, fit for a purpose or free of defects. No warnings means the checks that ran raised nothing; it is not a guarantee.
3.4 Statements are made as of the time shown and can become out of date.
3.5 We are not your security advisor. Decide whether to use a tool with your own judgment.
3.6 Our checks can be wrong in both directions: a check can report a problem that is not there, or miss one that is. We do not find every vulnerability, every harmful behaviour or every change.
3.7 You are responsible for judging each tool against your own systems, data and risk, and for what you install, connect or run.
3.8 Each statement, state and label is our assessment of the evidence linked to it, as of the time shown. The evidence is published with it so you can check it yourself and reach your own view. A statement describes what the evidence shows about a tool; it is not a statement about anyone's intent, honesty or character.
3.9 Do not use UND Assay to make decisions about a person, such as decisions about employment, credit, housing, insurance or other eligibility. It describes software, not people.
3.10 Evidence grade. Some tool pages show an evidence grade from A to E. It summarizes how many of the checks listed next to it confirmed what they check, on the date shown, under the method version shown. E means at least one listed check found evidence against what the tool or its listing states, and names that check. When too few checks could confirm anything, no grade is shown. A grade is our assessment of the evidence published with it (section 3.8). It is not a safety rating, security audit, endorsement, warranty or certification, and it is not a statement about the publisher. Publishers and users can ask for a recheck through the process in section 8.
4. Accounts
You must be 18 or older and give accurate information. Keep your API keys and webhook signing secret secret. You are responsible for activity under your account and keys.
5. Change alerts and webhooks
5.1 When you watch a tool, we check it about every hour and record an alert when a new version changed something we track. Alerts report observed changes with dates. They are not a safety rating, and an alert can arrive late, be missed, or describe a change incompletely.
5.2 If you give us a webhook address, we send alerts to it. You must have the right to use that address, and you are responsible for the service that receives the alerts. We may stop sending to an address that keeps failing, and we never send anything else to it.
6. Plans and payments
6.1 UND Assay has a free plan and paid plans (Pro, Team and Enterprise) at the prices shown on the pricing page. Paid plans buy volume and convenience (for example more watched tools, more API calls, delivery options and team seats). They never change a statement, a state, a finding or a ranking.
6.2 Paid plans are not on sale yet. Before anything can be bought, we will add the billing terms (renewal, cancellation and refunds) to this Addendum and ask you to accept that version first.
6.3 Founding member means one of the first 100 paying customers of UND Assay. A founding member keeps the price they first paid for as long as their subscription stays active without a break. Being a founding member gives no ownership, equity, share of profits, investment, loan, security, vote, control, partnership, employment or agency, and no right to any return.
6.4 No payment changes a statement. No payment, partnership or sponsorship can buy, remove or change a state, a finding, a label or a ranking. We do not sell sponsored placement or paid verification.
7. How to read our words
Words we use in marketing or on our pages, such as "founding", "founder", "member", "membership", "join", "support", "back", "community", "together", "funding goal", "trusted", "watch" or "verified publisher", describe the service. They are not promises of ownership, equity, an investment, a return, a partnership, employment, agency, control, or that any tool is safe. This Addendum and the Main Terms control over the website, marketing and any other description of UND Assay.
8. Disputes about our statements
If you believe a statement or a label is wrong, use the dispute process described on the Disputes & Corrections page, or write to [email protected]. You do not need an account to write to us. We acknowledge a dispute within 2 business days and aim to resolve it within 14 days. If we were wrong, we correct the statement and record the correction in the public corrections log. If we keep it, we tell you which evidence supports it.
9. Changes
We version this Addendum. When a change is material we say so on the site, we email the address on your account once, and your account page lists the documents that changed, with links to read them. Before you can use your account, the API, the MCP server or a connected app again, you must accept the new version; until then only reading what changed, downloading your data, deleting your account and signing out work. Earlier versions stay available.
What changed in 1.7: section 17 now gives the kinds of labels as examples and names one more (a listing whose package now names a different listing as its own). It describes labels each listing already explains, so it is not a material change and you do not need to accept it again.
10. Contact
[email protected]. Mailing address: Universal Network Development LLC, PO Box 560422, Orlando, FL 32856-0422.
11. "As is"
UND ASSAY IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE EXTENT THE LAW ALLOWS, WE DISCLAIM ALL WARRANTIES NOT STATED IN THIS ADDENDUM, WHETHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND NON-INFRINGEMENT.
12. Limits on our liability
TO THE EXTENT THE LAW ALLOWS, INCLUDING FOR CLAIMS BASED ON OUR NEGLIGENCE: (A) WE ARE NOT LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, DATA OR BUSINESS, ARISING FROM UND ASSAY; AND (B) OUR TOTAL LIABILITY FOR ALL CLAIMS ABOUT UND ASSAY WILL NOT EXCEED THE GREATER OF THE AMOUNT YOU ACTUALLY PAID US FOR UND ASSAY IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED U.S. DOLLARS (USD 100). This limit does not apply to liability that cannot be limited by law, including liability for our gross negligence or willful misconduct. A different limit applies only if a signed order form or master services agreement says so. The providers we rely on to run UND Assay may rely on sections 11 and 12 as if they were written for them.
13. Your responsibility to us
You will defend UND against, and pay the costs of, claims by others that arise from your breach of this Addendum or the Acceptable Use Policy, your misuse of our data (including any attack on a third party), content or claims you submit to us (disputes, domain claims, app registrations), or the services that receive your webhooks.
14. Features in development
Features we mark as in development (currently: reading the sign-in details and the tool lists that public servers publish) may be incomplete, change or stop, and carry no commitment beyond section 3.
15. Third-party services
Tools in the catalog, the services your AI connects to, and the services that receive your webhooks are run by others under their own terms. We do not control them and are not responsible for them.
16. Names and trademarks of others
Tool names, publisher names, logos and descriptions belong to their owners and are shown as the source supplied them. Listing a tool does not mean we endorse it or that it is affiliated with any company it names.
17. Labels on listings
We label a listing when our evidence shows something a reader should check before relying on it. Labels include, for example: a listing that uses a well-known name it has not proven it controls; a listing that shares its source with listings from other publishers; and a listing whose package now names a different listing as its own. A label states what our evidence shows. It is not an accusation, and the owner or publisher can ask for a review through Disputes & Corrections. When an app asks you to connect it to your account, we show its name as its own claim unless the place it sends you back to proves it.
18. How we read public servers
For tools with a public address, we connect the way any client does, without credentials, and record what the tool publishes about itself: its sign-in details and its list of tools. We never call a tool's functions. An operator can ask us to stop at [email protected], and we will.
19. Complaints about names and content
Send trademark or copyright complaints to [email protected] with the listing, the right you claim and how to reach you. We review each complaint and may label, correct or remove the listing.
20. Governing law and disputes
20.1 Talk to us first. Before starting any formal claim about UND Assay, send us written notice at [email protected] describing the dispute and what you ask for. We will both try in good faith to resolve it for at least 60 days from the day we receive your notice. We do the same before any claim against you. Any time limit for bringing the claim is paused during those 60 days.
20.2 Courts. Any dispute not resolved informally will be brought exclusively in the state courts located in Orange County, Florida, or in the United States District Court for the Middle District of Florida, Orlando Division. There is no arbitration. You and UND consent to the personal jurisdiction of, and venue in, those courts.
20.3 Law. This Addendum and the Main Terms, as they apply to UND Assay, are governed by the laws of the State of Florida, United States, without regard to its conflict-of-laws rules.
20.4 If part of this fails. If a court holds any part of this Addendum unenforceable, that part is limited or removed only as far as needed, and the rest stays in force.
20.5 Transfer. You may not transfer your rights under this Addendum without our written consent. We may transfer them, including as part of a merger, an acquisition or a sale of assets, or to another company that runs UND Assay.
20.6 Individual claims. To the extent the law allows, you and UND bring claims only individually, and not as a plaintiff or class member in any class, collective or representative action. This section and section 20.7 are each severable from the rest of this Addendum and from each other.
20.7 JURY WAIVER. TO THE EXTENT THE LAW ALLOWS, YOU AND UND EACH WAIVE ANY RIGHT TO A JURY TRIAL IN ANY DISPUTE ABOUT UND ASSAY.
20.8 What these terms never limit. Nothing in these terms limits your right to post an honest review or opinion about UND Assay, to complain to a government agency, or to any right the law does not allow a contract to remove.
21. Suspending access
If an account, API key or connected app breaks this Addendum or the Acceptable Use Policy, we may suspend or end its access. Where we reasonably can, we tell you first and give you a chance to fix it. We may act at once when we need to protect UND Assay, its users or anyone else, or when the law requires it.
22. Events outside our control
We are not responsible for delays or failures caused by events outside our reasonable control, such as outages of the networks or providers we rely on, attacks, natural disasters or government action.
23. Notices
We send notices to the email address on your account or show them on the site. You send notices to [email protected], or by mail to Universal Network Development LLC, PO Box 560422, Orlando, FL 32856-0422. An email notice counts as received when it is sent; a mailed notice when it is delivered to that box.
24. Feedback
If you send us ideas or suggestions about UND Assay, we may use them without any obligation to you.
Version 1.7 · in force since 2026-11-11
UND Assay — Privacy Notice Addendum
This Addendum adds to the UND Industries Privacy Policy at undindustries.com/privacy (the "Main Privacy Policy") for the UND Assay service at undassay.com. The Main Privacy Policy applies to UND Assay as if undassay.com were named in it, and UND is the controller of the personal data described here. Where they differ about UND Assay, this Addendum controls. Earlier versions are kept at undassay.com/legal.html (Earlier versions).
1. Data we collect from account holders
- Account: you sign in with your UND account (Google or an emailed code). UND Assay receives your UND account id and email address and records when the account was created. UND Assay never receives or stores a password.
- Agreements: which document and version you accepted, the document's SHA-256 fingerprint, the time, your IP address and browser user agent.
- API and MCP use: time, endpoint or tool name, query parameter names (not their values), status, response time, your API key or connected-app identifier, your IP address and user agent.
- Profile (optional): a display name you choose (any name or nickname; it does not need to be your real name) and a profile picture you upload. We remove photo details such as location before the picture is saved. Only you see them on your account today.
- Your activity: tools you watch, the change alerts we create for them, the webhook address you give us and whether deliveries to it succeeded, analyses you request, disputes you file, and domains you claim.
- Plans and payments (only if you buy): your plan, billing period (monthly or yearly), number of seats, when the plan renews or ends, the customer and subscription ids Stripe gives us for you, the lookup packs you bought and how many pack lookups you use each day, and which billing emails we sent you. We never see or store your card number.
- Founding places: to give one place per person, we keep a keyed hash (HMAC-SHA-256, made with a secret key that only our service holds) of the billing email, never the email itself, with the place number, plan and dates.
- Referrals: we keep the member's referral code; for each referral, which member referred which account, its status and dates, and a keyed hash (HMAC-SHA-256, made with a secret key that only our service holds) of the new customer's email, never the email itself. Neither person sees the other's name or email; the member sees only counts. The credit is applied through Stripe (customer balance).
- Newsletter (only if you subscribe): your email address, the version of the opt-in wording you agreed to, and when you subscribed, confirmed and unsubscribed. You do not need an account to subscribe.
- Teams: if you own a team, the email addresses you invited and whether each person joined. A member sees only the owner's email. An invite that is not accepted expires after 7 days; the address stays on your team list, marked expired, until you remove it or delete your account.
Daily use limit (everyone, with or without an account). To stop bulk copying of the catalog, we count how many catalog items are viewed each day through the website, the API and the MCP server. For an account, the count is kept under the account. Without an account, it is kept under a one-way code made from your IP address with a secret key; we do not store the address itself in this count. When a visitor says it is a search engine, we check its address with the search engine's published DNS method and keep the result under the same kind of code.
We never store your API keys, access tokens or webhook signing secrets in readable form. We never handle payment card data.
2. Change alerts, emails and webhooks
When a tool you watch publishes a version that changed, we record an alert on your account. The alert says which tool changed, the versions, and what changed.
- Email (off unless you turn it on): if you turn on alert emails on your account page, we email each new alert to your account's email address from [email protected]. With alert emails on, we also email you once when an analysis you asked us to run is published. Turn it off there at any time.
- Webhook: if you give us a webhook address, we send each alert to it, signed so you can check it came from us. The service at that address (for example Slack or Discord) handles the alert under its own terms. Remove the address at any time on your account page.
- When our terms change: if a document you accepted gets a new version, we email your account's address once about that version, from the same sender. This is a service notice about your account, so it is sent even if alert emails are off. We keep a record of which notices we sent.
- Security notices: when a new API key is created on your account or an app is connected to it, we email your account's address once about that key or app, from the same sender, so you can spot one you did not make. This is a service notice about your account, so it is sent even if alert emails are off. We keep a record of which notices we sent. Email can be delayed or missed, so the keys and apps on your account page are the full list.
- Dispute replies: when we reply to a dispute you filed, or resolve it, we email your account's address our reply, from the same sender. This is a service notice about your dispute, so it is sent even if alert emails are off. We keep a record of which notices we sent. Email can be delayed or missed, so your account page, which shows each dispute and our latest reply, is the full record.
- Billing emails (only if you buy): we email your account's address the purchase confirmation with the renewal terms and how to cancel, a reminder 30 to 45 days before a yearly plan renews, and any notice the Terms require before a change to your plan. These are service emails about your purchase, so they are sent even if alert emails are off. We keep a record of which ones we sent.
- The Assay Brief (off unless you subscribe): about one email a month from [email protected] about changes in the catalog and in UND Assay. We first send one email to confirm the address; nothing else is sent until you confirm. Every issue has an unsubscribe link, and members can also turn it off on the account page. Open and click tracking is turned off for these emails.
3. Data about people we collect from public sources
Package registries, the official MCP Registry and GitHub publish the names, usernames and profile images of software publishers and maintainers. We show this public information to identify who publishes a tool.
- Legal basis (EU/UK): our legitimate interest, and the public's, in knowing who publishes software.
- Your choice: you may object or ask for correction at [email protected]. We will remove personal details that are not needed to identify a publisher.
4. Who processes data for us
- Cloudflare hosts the website, the API and the MCP server, stores the database, keeps request logs, forwards email sent to our @undassay.com addresses, protects the service from attacks, and counts visits to our public pages (Cloudflare Web Analytics, see section 7).
- Supabase runs UND sign-in (your account id and email address).
- Stripe runs checkout, payments, invoices, tax calculation where it applies, and the billing page where you change or cancel a plan. Stripe receives your email address, what you buy, and the payment details you enter on Stripe's own page (card, name, billing address or country). We receive back the ids, the plan, the billing period and whether it was paid. Stripe's privacy policy also applies to what you give Stripe.
- Resend sends alert emails and analysis-ready emails if you turn them on, billing emails if you buy, security notices, replies to your disputes, the one-time email when our terms change (your email address and the message), and the newsletter if you subscribe (your email address; Resend keeps the list of confirmed subscribers for us).
- Google signs you in if you choose Google.
- GitHub stores our source code. It does not receive your account data.
5. How long we keep data
6. Your rights
On your account page you can download everything UND Assay holds about your account and delete your account. Deleting removes your account, sign-in methods, API keys, connected apps, watchlist, alerts, alert-email setting, terms-change, billing, security and dispute-reply email records, webhook, requests, disputes, claims, lookup packs and team links at once. A paid plan must be cancelled first. What stays is described above: the security audit log, payment records in Stripe, a used founding place without its link to you, and the keyed hash of a used referral. If we corrected a statement because of a dispute you filed, the correction stays in the public corrections log: it holds only the tool, the statement, what we changed and when, never your name, account or what you wrote. You can also write to [email protected] to ask for a copy, a correction or deletion.
7. Advertising and cookies
Ads from Google AdSense may appear on these public pages: home, browse, tool, publisher, compare and methodology. They never run on the search, sign-in, account, legal, connect, disputes or AI-agent pages, and never inside tool evidence.
On those pages your browser loads ad code from Google, a separate company. Google and its partners may use cookies or similar identifiers to show and measure ads, limit how often you see one, and detect fraud, and may use your visits to this and other sites to personalise ads. Google's own privacy policy covers what Google does with that data; how Google uses information from sites that show its ads is explained at policies.google.com/technologies/partner-sites. We do not give Google your account, your email address or anything you do while signed in.
Your choices: you can turn off personalised ads from Google at adssettings.google.com, and opt out of personalised ads from many other companies at aboutads.info/choices (youronlinechoices.eu in Europe). Visitors in the European Economic Area, the UK and Switzerland see Google's consent message about personalised ads. You can also block or delete cookies in your browser; UND Assay keeps working without them.
Paying for ads never changes how a tool is ranked or assessed.
Cookies: UND Assay's own cookies keep you signed in and protect sign-in from forgery. Your browser also stores your colour theme. UND Assay itself sets no advertising or tracking cookies; on the ad pages above, Google may.
Visit counting: our public pages load Cloudflare Web Analytics to count visits; the sign-in, account, connect and search pages do not. It sets no cookie. Cloudflare shows us only totals, such as which pages were viewed, referring sites, countries, browsers, devices and page load times, not who you are.
8. AI clients
When an AI assistant uses the API or MCP server for you, we log the connected app's identifier and your account, not the content of your conversation with the assistant.
What a connected app can see. When you connect an app (for example an AI assistant, including SAI, which UND also makes), you approve read-only access. The app can read UND Assay's evidence about tools through the API and MCP server, under your account and its limits. It cannot see your email address, your account settings, your API keys, your watchlist, your webhook or your other connected apps; those are available only on your account page while you are signed in. The app handles what you ask it and what it receives under its own terms and privacy policy. You can disconnect any app at any time on your account page, and the app's access ends at once.
9. Age
UND Assay accounts are for people 18 or older.
10. Changes
We version this Addendum. When a change is material, we ask you to accept the new version before you continue using account features, the API or the MCP server. Earlier versions stay available.
What changed in 1.10: security notice emails when a new API key is created or an app is connected (section 2), and their records in sections 4, 5 and 6. This adds a protection. It uses details we already hold (your email address, the key's label, the app's name) and keeps a record of each notice sent, deleted with your account, so it is not a material change and you do not need to accept it again.
What changed in 1.11: an email with our reply when we answer or resolve a dispute you filed (section 2), and its record in sections 4, 5 and 6. It uses details we already hold (your email address, the dispute and our reply) and keeps a record of each email sent, deleted with your account, so it is not a material change and you do not need to accept it again.
What changed in 1.12: with alert emails on, one email when an analysis you requested is published (section 2). It uses details we already hold (your email address and your request), is covered by the same on/off switch as alert emails, and its send time is kept on the request, deleted with your account, so it is not a material change and you do not need to accept it again.
What changed in 1.13: an optional newsletter (sections 1, 2, 4 and 5). Nobody is added without ticking the box and confirming by email, and it can be turned off at any time, so it is not a material change and you do not need to accept it again.
11. Contact
[email protected]. Mailing address: Universal Network Development LLC, PO Box 560422, Orlando, FL 32856-0422.
Version 1.13 · in force since 2026-11-11