Shyne
Download
macOSApple silicon · .dmgWindows64-bit · .exe
Anmelden
Download
macOSApple silicon · .dmgWindows64-bit · .exe

Shyne · Trust

Security and data handling

How Shyne handles project access, AI data, API authentication, and the desktop app’s local MCP endpoint.

Reviewed 3 August 2026Contentable Pty LtdAustralia

What this page covers

This is a plain-language description of the safeguards and trust boundaries visible in the current Shyne product. It does not claim a security or compliance certification.

Project data

Shyne uses encrypted HTTPS connections for hosted traffic. Hosted project reads and writes are checked against the signed-in user or organization and the project’s access rules.

Connected-provider credentials are encrypted before storage and are not returned to AI agents. The privacy policy is the controlling statement for collection, retention, subprocessors, and legal rights.

AI processing

When you use an AI feature, the prompt and the project context needed for that request can be sent to the selected model provider. Shyne does not use customer content to train its own models, and engages model providers on terms that prohibit training on that content.

Hosted API and MCP access

The hosted MCP endpoint uses OAuth. The public REST API uses organization API keys created in Settings. Hosted project operations perform access checks before a project is opened or changed.

  • Keep API keys in a backend or secret manager, never in browser code or a URL.
  • Revoke an exposed API key in organization settings.
  • Use the API guide and the MCP guide for current connection details.

Desktop local MCP

The desktop app serves a local MCP endpoint at http://127.0.0.1:7655/mcp while the app is running and signed in. It binds to the loopback interface, so other machines cannot connect to it directly.

The local port has no separate authentication. Any process running in your local user session that can reach that port can act through the signed-in Shyne session. Those actions still use your project access, but they can read or change projects you can access.

  • Connect only AI clients and local software you trust.
  • Do not proxy, tunnel, or expose port 7655 to another network.
  • Close the desktop app to stop the local MCP endpoint.

Questions and reports

Use the contact form for a security question, vulnerability report, or procurement request. Include a safe way to contact you and do not send live credentials or private customer content.