Terms of Service

These Terms of Service ("Terms") are a binding agreement between you and Programmable, LLC, a limited liability company based in Washington, DC, USA ("we", "us"), and cover your use of programmable.run: the website, the signed-in app, the hosted MCP endpoint at your workspace URL, and every related feature (together, the "Service"). Please read them carefully. Section 18 requires most disputes to be resolved by individual binding arbitration and waives class actions; you can opt out within 30 days.

1. The agreement and how you accept it

You accept these Terms by signing in to programmable.run with your Programmable account, by creating an access key, or by sending a request to your workspace URL with one. If you use the Service for an organization, you accept them on its behalf and confirm that you have authority to bind it; "you" then means that organization. These Terms include the Privacy Policy, the Cookie Policy and, once you accept it, the Data Processing Agreement ("DPA"). If you don't agree, don't use the Service.

Changes. We may update these Terms. For material changes we'll email account owners and post the new version here at least 15 days before it takes effect (sooner where a change is required by law or addresses a security or legal risk). Using the Service after a change takes effect, including through an access key, counts as acceptance. If you don't accept a change, stop using the Service and you may close your account.

2. Who can use the service

• You must be at least 18 and able to form a binding contract. The Service is for business and professional use.
• You may not use the Service if you are, or act for, a person on a US sanctions list (such as OFAC's SDN list) or are located in a country or region under comprehensive US sanctions, and you won't use it in breach of US export-control or sanctions laws.
• You may not use the Service to build or support a product that competes with it, or to benchmark it for a competitor, without our written permission.

3. The service

programmable.run is a hosted server that speaks the Model Context Protocol ("MCP"). You add APIs to it (from an OpenAPI or Swagger specification, a Postman collection, a link to one, or our catalog), save the API key or token each one needs, and create access keys for your AI clients (such as Claude Code, Cursor or VS Code). Your AI client can then search those APIs, read an endpoint's parameters and call it. We make the call to the API from our servers, attach your saved credential, and return the response to your AI client.

The Service is in preview. We may change, add or remove features, supported formats and catalog APIs, set or change usage limits, and introduce paid plans (see section 10). Features labelled beta, preview or experimental are provided as they are, may change or stop, and may be less reliable.

4. Accounts, access keys and your AI clients

• You sign in with the shared Programmable account. Give accurate account information and keep it up to date. You're responsible for everything done through your account and its access keys.
• Access keys connect an AI client to your workspace URL. Each is shown once and stored only as a hash. Anyone holding a key, or a client configured with it, can act within that key's rules. Keep keys secret, revoke keys you no longer trust, and tell us promptly at [email protected] if you suspect unauthorized use.
• Your AI clients are software you choose and run. Calls they make with your key are your calls. We aren't responsible for what an AI client decides to do; the rules in section 6 exist so you can limit it.
• Use the Service only as documented and within the rate limits and quotas we set. Don't try to get around them or use multiple accounts or keys to exceed them.

5. The APIs you add and the keys you save

You keep all rights to the specifications, collections and other material you add, to the API keys and tokens you save, and to the data that flows through your calls (together, "your data"). We don't claim ownership of your data and we don't sell, rent or share it. You give us a limited, non-exclusive licence to process your data only as needed to provide the Service to you: to turn a specification into callable endpoints, to attach your saved credential to the calls your AI client makes, to deliver responses, to keep the Service secure, and to comply with law. We don't use your data to train AI models.

• An API you add from a specification is private to your account. APIs in our catalog are shared descriptions of public APIs; the credential you save for one is yours alone.
• Saved API keys and tokens are stored encrypted and are attached to calls on our side. They are never returned to you or to your AI client after you save them. You can replace or remove them at any time.
• You confirm that you have the right to add each specification and to use each credential you save, including under the terms of the API it belongs to, and that you have any notices or consents needed for the data your calls carry.
• Where your calls carry personal data, you are the controller (or "business") and we are your processor (or "service provider"); the DPA applies when you accept it.

6. Rules, approvals and the activity log

Each access key has rules that decide what happens to a call: run it, ask you first, or block it, by kind (reading, writing or deleting), plus a daily call limit. By default reads run, writes wait for your approval, and deletes are blocked. When a call waits for you, we hold its arguments and give your AI client a link; if you approve, that exact call runs once and the approval is then spent. You choose the rules and you can change them per key at any time.

The rules are applied to the kind of call as the API's specification declares it. A specification that declares an endpoint wrongly (for example a deleting endpoint marked as a read) will be treated as declared. Review the endpoints of an API you add before you trust an AI client with it. We keep an activity log of every call made with your keys (section 5 of the Privacy Policy says what it holds).

7. Acceptable use

You won't, and won't let anyone or any AI client acting with your keys:

• call an API in breach of its terms, rate limits or access controls, or with credentials you aren't entitled to use;
• use the Service to attack, probe, overload or scrape any system, to send unsolicited bulk messages, or for phishing, fraud or any unlawful purpose;
• add a specification that points at our own infrastructure, at private networks, or at a service in order to gain access you don't have;
• process sensitive personal information (such as health, financial account or government ID numbers) or data about children through the Service without the rights and safeguards the law requires;
• get around the rules, approvals, daily limits, access controls or bot protections, or test the Service for vulnerabilities without our written permission;
• reverse engineer the Service or extract its source code, catalog or methods, except where the law allows despite this restriction;
• resell, sublicense or provide the Service to third parties (for example as a white-label offering) without a written agreement with us.

8. Third-party APIs and services

The APIs you add and call are provided by third parties under your agreements with them, not by us. When you save a credential and your AI client calls an API, you authorize us to send that API the request on your behalf, including your credential and the arguments, and to receive the response. You're responsible for complying with each API's terms, for its charges, and for the permissions a credential carries. We're not responsible for a third-party API's availability, accuracy, security, charges or acts, and we may stop supporting one at any time, for example if it changes its terms. Our catalog describes public APIs as their published documentation describes them; a description can be out of date or wrong.

9. AI clients and what they do

An AI client decides which endpoints to search for and call, and with what arguments, from what you ask it. Its decisions can be wrong, incomplete or unexpected. The rules in section 6 are there to limit the consequences; use them, and review approvals before you grant them. We don't run or provide the AI model, and we're not responsible for its output or choices. Don't rely on the Service for decisions with legal or similarly significant effects about people.

10. Fees and limits

The Service is free during the preview. We may set usage limits (such as calls per day) and may introduce paid plans; if we do, we'll give at least 30 days' notice by email and nothing you already use will become chargeable without your agreement. Charges from the APIs you call are billed to you by those providers, not by us.

11. Our intellectual property

We and our licensors own the Service, including its software, catalog, methods, design, documentation and brand. Subject to these Terms, we give you a limited, non-exclusive, non-transferable, revocable right to use the Service while your account is in good standing. We reserve all rights not expressly granted. If you send us feedback or suggestions, we may use them freely without obligation to you. You may not use our name or logo without permission, except to refer to the Service accurately. If you believe something in the Service infringes your copyright, email [email protected] with the details required by the Digital Millennium Copyright Act.

12. Confidentiality

Each of us will protect the other's non-public information that is marked confidential or should reasonably be understood to be (for us, your data and your credentials; for you, non-public details of the Service and security information), use it only for this agreement, and share it only with people who need it and are bound by similar duties. This doesn't cover information that is or becomes public through no fault of the recipient, was already known to it, is independently developed, or is rightly received from someone else. Either of us may disclose information when the law requires, after giving notice where allowed.

13. Suspension

We may rate-limit, pause or suspend all or part of your access, with notice where practical, if we reasonably believe that your use breaks these Terms or the law, threatens the security, integrity or availability of the Service, or exposes us or others to liability. We'll restore access once the issue is resolved. We may revoke access keys that we believe are compromised or misused.

14. Term and termination

These Terms apply while you use the Service. You can stop at any time: revoke your access keys, remove your APIs and saved credentials, and ask us at [email protected] to delete your account (deletion is described in the Privacy Policy and can't be undone). We may end these Terms or close your account for convenience with 30 days' notice, or immediately if you seriously or repeatedly breach them, including any breach of section 7, or if required by law.

When your account ends, your right to use the Service stops, your access keys stop working, and your saved credentials are deleted. Sections 5 (last paragraph), 7, 11, 12 and 15 to 19 survive.

15. Disclaimers

The Service is provided "as is" and "as available". To the fullest extent the law allows, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy and completeness, and any warranties arising from course of dealing or usage of trade. We don't warrant that the Service will be uninterrupted, secure or error-free, that an API description is accurate, or that an AI client will act as you intend.

16. Limitation of liability

To the fullest extent the law allows: (a) neither we nor our suppliers will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, goodwill or data, or business interruption, however caused and even if advised of the possibility; and (b) our total liability arising out of or relating to the Service or these Terms will not exceed the greater of the amounts you paid us in the 12 months before the event giving rise to the claim and US$100. These limits apply to every theory of liability and even if a remedy fails of its essential purpose. They don't limit liability that the law says can't be limited, or your obligations under section 17.

17. Indemnification

You will defend, indemnify and hold harmless us, our affiliates and our and their officers, employees and agents from any third-party claim, and the resulting losses, damages, fines, penalties, costs and reasonable attorneys' fees, arising out of (a) your data or your credentials, (b) calls made with your keys, including by an AI client, (c) your breach of these Terms or of law, including section 7, or (d) your use of third-party APIs. We'll give you prompt notice of the claim, reasonable cooperation at your expense, and control of its defence, but you can't settle a claim that imposes obligations on us without our written consent.

18. Disputes: arbitration and class-action waiver

Talk to us first. Before starting a claim, email [email protected] with a description of the dispute and what you want; we'll do the same with you. Both of us will try in good faith to resolve it for 60 days.

Binding arbitration. If we can't resolve it, any dispute, claim or controversy arising out of or relating to these Terms or the Service, including their formation, scope or enforceability, will be resolved by final and binding individual arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, in Washington, DC or by video. The Federal Arbitration Act governs this section. Judgment on the award may be entered in any court with jurisdiction.

Exceptions. Either of us may bring an individual claim in small-claims court, and either of us may seek an injunction in court to stop actual or threatened infringement or misuse of intellectual property, confidential information or the Service (including breaches of section 7).

No class actions. Claims may be brought only individually, not as a plaintiff or class member in any class, consolidated or representative proceeding, and the arbitrator may not consolidate claims or award relief to anyone other than the individual party. If this waiver is found unenforceable for a claim, that claim must be heard in court, not in arbitration. If 25 or more similar claims are filed by or with the help of the same counsel, they will be administered in batches as the AAA's mass-arbitration procedures provide.

Opting out. You can opt out of this section 18 by emailing [email protected] within 30 days of first accepting these Terms, from your account's email address, with the subject "Arbitration opt-out". Opting out doesn't affect any other part of these Terms. If we change this section materially, you may reject the change by the same method within 30 days of its effective date.

Time limit. To the extent the law allows, any claim must be started within one year after it arose, or it is permanently barred.

19. General

• Governing law and venue. These Terms are governed by the laws of the District of Columbia, USA, without regard to its conflict-of-laws rules. Subject to section 18, disputes go to the state or federal courts located in Washington, DC, and both of us consent to their jurisdiction.
• Electronic communications and notices. You agree to receive agreements, notices and other communications from us electronically, by email to your account address or in the app, and that they satisfy any requirement to be in writing. Send notices to us at [email protected], with a copy by mail to Programmable, LLC, 3607 10th St NW, Washington, DC 20010, USA.
• Assignment. You may not assign or transfer these Terms without our written consent. We may assign them in connection with a merger, acquisition or sale of all or most of our business or assets.
• Force majeure. Neither of us is liable for delays or failures caused by events beyond reasonable control, such as outages of internet, hosting or third-party providers, natural disasters, war, labour disputes or government action.
• Independent parties. We are independent contractors; nothing here creates a partnership, joint venture, agency or employment relationship. There are no third-party beneficiaries.
• Severability and waiver. If any part of these Terms is unenforceable, it will be changed to the minimum extent needed and the rest stays in effect. Not enforcing a provision isn't a waiver.
• Entire agreement. These Terms, with the documents in section 1 and any written agreement signed by both of us, are the entire agreement about the Service and replace earlier understandings. If they conflict, a signed agreement wins, then the DPA (for personal data), then these Terms.
• Government users. The Service is commercial computer software and documentation, provided to US government users only with the rights in these Terms.
• Questions: [email protected].