Terms of Service
1. Who you are contracting with
These terms govern your use of the Cakewalk MCP Test Kitchen that we host. That means the landing page, the console and the MCP endpoint, together the "Test Kitchen". The source code is licensed separately, as § 6 explains.
The Test Kitchen is operated by Cakewalk Technology GmbH, Hardenbergstraße 32, 10623 Berlin, Germany, registered at Amtsgericht Charlottenburg under HRB 229577 B ("Cakewalk", "we", "us").
These terms cover the Test Kitchen only. They are not the terms for the Cakewalk platform at app.getcakewalk.io, which is governed by a separate agreement.
The Test Kitchen is built for developers who want to test an MCP client. You can use it whether you are doing that for work, for a business of your own or on your own account. Nothing here restricts it to companies.
By signing in, you accept these terms. If you do not accept them, do not sign in.
2. What the Test Kitchen does
The Test Kitchen is a fault injection sandbox. It is an MCP server that deliberately misbehaves. It returns malformed responses, protocol violations, transport failures and tool errors, so you can watch how your MCP client handles them.
It is designed to break things. That is the product.
3. It is free, and it is not guaranteed
The Test Kitchen is provided free of charge, with no time limit and no beta period after which charging begins.
Because it is free, you get no entitlement to it. We may change it, limit it, or withdraw it entirely, at any time and without notice. We are under no obligation to keep any feature, scenario or endpoint working.
4. Your account and your token
You need an account to use the Test Kitchen. You sign in with Google or GitHub.
We mint a personal access token that you paste into your MCP client. You get one token per account. You must:
· keep your token secret, because it authenticates as you
· use one account for yourself, and not share it
· give accurate information when you sign in
You are responsible for all traffic sent using your token. If it leaks, regenerate it in the console. Doing so invalidates the old one immediately.
We use your email address to sign you in, and to contact you about the Test Kitchen itself. We do not use it for marketing, we do not add it to a mailing list, and we do not give it to anyone else.
5. Acceptable use
5.1 What you must not send through the Test Kitchen
This is the most important term in this document.
The Test Kitchen records the requests your client sends. It keeps metadata about every request and a summary of its parameters. The Privacy Policy §4.3 describes exactly what, and it is narrower than you might assume: tool call arguments are discarded, and larger parameter objects are not stored at all.
That is not a reason to relax. Smaller parameter objects are stored, in full, and we do not inspect them for personal data. So:
Do not send personal data, customer data, production data, credentials, API keys, secrets, or anything confidential through the Test Kitchen.
Use synthetic data. Treat everything you send as disclosed to us, stored on our schedule and deleted on our schedule, not yours. If you send personal data anyway, you do so on your own responsibility.
5.2 What you must not do
· point automated load, stress or benchmark traffic at the endpoint
· wire it into CI or anything else that depends on it being up, because it is for sitting down and probing a client by hand
· attack, probe or attempt to gain unauthorized access to the service or other users' data
· circumvent rate limits, or use multiple accounts to get more capacity
· resell access to the Test Kitchen, or offer access to it as part of a service of your own
· use it unlawfully, or to build something that infringes someone's rights
5.3 Rate limits
The MCP endpoint accepts 120 requests per minute, counted per IP address. Console actions are limited separately: 30 per minute for token operations, and 5 per ten minutes for feedback submissions and for data erasure. Over the limit you receive an HTTP 429. Requests are rejected rather than queued.
We may change these limits at any time, and may throttle or block traffic that threatens the availability of the service.
5.4 If you break these rules
We may suspend or delete your account and revoke your token, with or without notice. For anything that is not urgent we will try to tell you first, but we are not obliged to.
6. Open source code
The Test Kitchen's source code is public in two GitHub repositories. One holds the server, its console and its scenarios. The other holds a reference test client: a small MCP client that shows how to connect to the Test Kitchen and how to handle what it sends back.
Both are licensed to you under the MIT License. You may use them, change them, run your own copy and put parts of them into your own code, including in commercial work. The license text in each repository's LICENSE file governs the code.
These terms do not apply to a copy you run yourself. We do not operate or support it, and our rate limits and Privacy Policy cover only the copy we host.
The code depends on third-party packages that carry their own licenses. Those are not ours to grant, and their terms travel with the packages.
7. Intellectual property
We keep the copyright in the code and license it to you under § 6. The Cakewalk and MCP Test Kitchen names and logos, the hosted Test Kitchen and our documentation outside the two repositories stay ours. Nothing in these terms transfers ownership to you.
You may use our names and logos only to say, factually, that you used the Test Kitchen or that your copy is based on it. If you run a changed copy, do not call it MCP Test Kitchen or present it as ours.
Whatever you send through the Test Kitchen stays yours. We use it only as described in the Privacy Policy.
8. No warranty
The Test Kitchen is provided "as is" and "as available", with no warranties of any kind.
We specifically do not promise that it will be available, that it will stay available, that it will behave the same way twice, or that any fault it injects corresponds to a real world failure mode. There is no SLA and no uptime commitment. Do not build anything on it.
The whole point of the service is that it returns broken, malformed and unexpected responses. Anything you point at it must be something you can afford to have break.
9. Liability
We are liable without limitation for damage caused intentionally or by gross negligence, for injury to life, body or health, under the German Product Liability Act, and where we have given a guarantee.
For simple negligence we are liable only where we breach a material contractual obligation, meaning an obligation whose fulfillment is essential to performing this agreement and on which you may reasonably rely, and in that case only for foreseeable damage typical of this kind of agreement.
The Test Kitchen is provided free of charge. The statutory rules on liability in gratuitous relationships (§§ 521, 599 BGB) remain unaffected.
All other liability is excluded. In particular we are not liable for lost profits, business interruption, or any consequential loss.
The records the Test Kitchen holds are not a place to keep anything. They are deleted after seven days by design, they hold synthetic test traffic if you follow § 5.1, and you should have nothing here that you do not have elsewhere. Where we are liable for their loss at all, that liability is limited to what it would cost you to send the traffic again.
Deleting your records after seven days is how the Test Kitchen is meant to work, not a fault. The same is true when you delete everything yourself. In neither case have you lost anything you were promised.
10. Your responsibility
You are responsible for what you connect to the Test Kitchen, for the data you send it, and for the consequences of the faults it returns to your client.
If you are using the Test Kitchen for work or for a business of your own, and someone brings a claim against us because of what you sent or did, you will cover the reasonable costs of defending it. If you are using it privately, this paragraph does not apply and the general law decides who pays.
11. Ending it
You can stop at any time. Use the ERASE EVERYTHING button in the console. It permanently deletes your observation records, your saved scenario and your access token, terminates your sessions and signs you out. We hold no separate account record, so there is nothing further to delete on our side.
Revoking this application's access to your Google or GitHub account is a separate step, in your account settings with that provider. The button cannot do it for you.
We can suspend or terminate your access at any time, for any reason, including discontinuing the service entirely.
12. Changes to these terms
We may change these terms. The current version is always at https://www.cakewalk.security/mcp-test-kitchen/legal/terms, with the date at the top.
If a change affects you in a way that matters, we will tell you at least 30 days before it takes effect, on the landing page or by email. Keep using the Test Kitchen after that date and the new terms apply. If you would rather not, press ERASE EVERYTHING in the console before then. You can do that at any time, for any reason.
13. Privacy
The Privacy Policy at https://www.cakewalk.security/mcp-test-kitchen/legal/privacy explains what we collect and how long we keep it. Read it before you connect, particularly §4.3 on request parameters and §4.4 on headers.
Short version: records are deleted after seven days, the service and its database run in the EU, there is no analytics or tracking of any kind, and your email address is used to sign you in and nothing else.
14. Governing law and venue
These terms are governed by the law of the Federal Republic of Germany, excluding its conflict of law rules and the UN Convention on Contracts for the International Sale of Goods. If you are a consumer resident in the EU, this choice does not take away the protection of any mandatory rule of the law where you live.
Berlin is the place of jurisdiction for all disputes if you are a merchant, a legal person under public law or a special fund under public law, or if you have no general place of jurisdiction in Germany. If you are a consumer, the statutory rules decide where a case is heard.
15. Consumer dispute resolution
We are not obliged to take part in dispute resolution proceedings before a consumer arbitration board, and we do not take part voluntarily.
16. Everything else
If any provision of these terms is invalid, the rest stays in force.
Cakewalk Technology GmbH Hardenbergstraße 32, 10623 Berlin, Germany service@getcakewalk.io