01
Transport & authentication
Fail-open auth, default bind on all interfaces, endpoints with no credential check.
Managed AI services, MCP servers, copilots and agents, and the databases and systems they connect to. We check how you wire and expose it, with special depth on the agent and MCP layer that standard scanners barely touch, and back every finding with a runnable proof of concept.
A copilot reads emails, an agent opens tickets and documents, an MCP server passes on access to databases, inboxes and internal tools. If one of those contents carries a hidden instruction, the AI may carry it out, with exactly the permissions you gave it. We test what your AI is allowed to do, where it can be abused and how to scope its permissions so that a mistake does not turn into damage.
Once a model executes tools with your credentials while reading untrusted content, the threat model flips: an instruction embedded in a page, an issue or a document can steer the agent into writes or deletes, a 'read-only' switch often holds only on paper, and a transport without real authentication hands the server's full authority to anyone who can reach the port. These are not theoretical risks, they are the patterns we found in real MCP servers.
From the client through the agent, the MCP server, execution and the network to your data, the supply chain and inter-agent communication. This map shows the classes we check at every layer, with references to the OWASP MCP Top 10 and the OWASP Top 10 for Agentic Applications.
Fail-open auth, default bind on all interfaces, endpoints with no credential check.
Locally bound servers a web page can drive via DNS rebinding.
Untrusted content verbatim in context, next to destructive tools and egress (lethal trifecta).
Server-side fetches with no scheme/IP allowlist, redirects without revalidation, metadata endpoints.
Shell execution, bypassable guards, sandbox escapes up to host compromise.
Unbounded paths, symlink escapes, arbitrary read and write.
Passthrough tools that allow arbitrary backend calls with your credentials.
readonly/allowlist/denylist checks defeated by unicode, quoting or wrappers.
Credentials in logs/argv/config resources, shipped defaults that expose instead of protect.
We have reviewed dozens of open-source MCP servers under coordinated disclosure. A finding is only reported once it has been demonstrated against the real code. Publicly verifiable: CVE-2026-15583 (Grafana MCP Server), CVE-2026-114123 (d365fo-mcp-server), CVE-2026-104776 (mcp-server-kubernetes), CVE-2026-110787 (pREST), reported under coordinated disclosure and fixed by the maintainers. We apply the same method to your server.
We map tools, transports, credentials and data flows, and mark where authority meets influenceable input.
We test against a fixed list of rules that must never break, and try to refute every finding before we report it. What remains is demonstrated against the real code.
A proof of concept per finding, a deny-by-default policy, prioritized fixes and a retest after remediation.
Honest, not a feeling of safety. We verify every finding adversarially against the real code before we report it. And where a server is clean, we say so; 'no finding' is never the same as 'secure'.
A free initial call of your agentic feature. We name the one property your security depends on and tell you whether it holds.