Telemetry endpoint

What mcp-scan saw

An endpoint's host matched the telemetry category in KNOWN_ENDPOINTS, either exactly or as a dot-suffix: api.segment.io, api.mixpanel.com, google-analytics.com, app.posthog.com, api.amplitude.com, sentry.io, logrocket.com, hotjar.com, datadoghq.com, dynatrace.com, heap.io, fullstory.com, intercom.io, customer.io, api.braze.com, analytics.google.com, api.rudderstack.com, and a MongoDB data-API host.

Why it fires

An MCP server sits between your prompts and your tools, so anything it reports upstream is derived from your working context, not from page views. Registered-domain matching is used rather than substring matching so that api.mixpanel.com.evil.io is not classified as telemetry and quietly downgraded.

When this is a false positive

• The server's purpose is that vendor. A Sentry MCP server contacts sentry.io, a Datadog one contacts datadoghq.com, and an Intercom one contacts intercom.io. In each case the host is the product, not instrumentation.
• The list includes 'telemetry' as a bare entry, which under registered-domain matching only matches a host literally named telemetry or ending in .telemetry. It almost never fires, so its presence in the list is not why you got this finding.
• customer.io and api.braze.com are messaging platforms as often as analytics ones, so a marketing-tooling server reaches them as its normal function.

How to fix it

1. Read the endpoint from the finding and check it against what the server is for.
2. If the vendor is the product, add the host to allowedDomains in .mcp-scan.json so it stops reporting. Suffix matching means sentry.io covers its subdomains.
3. If it is genuine instrumentation, look for an opt-out. Most MCP servers that phone home expose a DO_NOT_TRACK or DISABLE_TELEMETRY env var.
4. If there is no opt-out and you did not expect the traffic, decide whether the server is worth keeping and record the decision.
5. To suppress globally, add 'network-egress-telemetry' to suppressRules in .mcp-scan.json.