Access and auth
Flag missing authentication signals, default credentials, broad CORS settings, and transport issues that make MCP endpoints too easy to reach.
MCP security review readiness
Pass the security review on your MCP server.
MCP Signoff gives software teams a reviewer-ready evidence packet for their MCP server, mapped to the OWASP MCP Top 10 and AIUC-1 MCP controls, in five business days. Start with the free local scanner.
A-F security grade
JSON, HTML, Markdown, and SARIF reports
CI threshold support
Governance-ready evidence
Purpose-built checks for MCP production risk.
MCP Signoff focuses on the access patterns that matter when agents can call real tools: authentication, sensitive outputs, network reach, dangerous tool descriptions, unsafe defaults, and the evidence a security reviewer expects to see.
Tooling exposure
Review tool names, descriptions, permission breadth, prompt-facing language, and shadow-tool patterns that can confuse agents or users.
Input and output risk
Detect SSRF, command-injection, path traversal, SQL-injection, sensitive data, excessive data, and error-disclosure patterns.
Evidence security and engineering can both use.
Every scan result is designed to move from finding to owner to fix, with evidence, business impact, remediation guidance, and a clear grade for release decisions, pilot reviews, and customer security conversations.
Sample report package
Share a sanitized report package with an executive summary, MCP server inventory, findings table, detailed evidence, remediation checklist, and out-of-scope notes.
- No authentication hintsHigh
- URL-fetching tool SSRF riskHigh
- Prompt-injection tool copyMedium
- Sensitive data pattern in outputMedium
- TLS probe warningLow
Need an MCP security audit before launch?
The buyer-intent audit page explains the fixed-scope review, OWASP-style risk coverage, and report package for teams comparing MCP security scanners, manual reviews, and gateway readiness.
Free scanners produce signals. The audit produces a decision packet.
Run the local scanner whenever you want a fast baseline. Buy the audit when somebody has to decide whether MCP access is ready for a customer pilot, enterprise security review, agent rollout, or production-like workflow.
Reviewed evidence
Scanner output is checked against context: which systems are in scope, which tools can write or delete, and which findings matter before broader rollout.
Remediation priority
Findings are ranked by business impact, exploitability, and owner. The output is a practical fix list, not a raw alert dump.
Buyer-safe summary
The report includes a sanitized summary that engineering, AppSec, leadership, or a customer security reviewer can read without exposing secrets or private configs.
Fixed-price packs for the review in front of you.
Pick the pack that matches who is reviewing you: an enterprise customer, a client at handoff, or a deal that needs hands-on testing.
Agency Handoff Pack
For agencies and consultancies handing an MCP server or agent workflow to a client.
$1,500fixed price
- One MCP server or agent workflow
- Client-ready evidence packet
- Permission and approval map
- 5 business days after complete intake
Security Review Readiness Pack
For software companies whose MCP server is facing an enterprise customer security review.
$2,500fixed price
- Evidence packet mapped to OWASP MCP Top 10 and AIUC-1 MCP controls
- Answers to the MCP questions reviewers ask
- Shareable signoff letter
- 1 retest after fixes, 5 business days
Readiness Pack + Manual Testing
For vendors with a named enterprise deal waiting on the security review.
$5,000fixed price
- Everything in the Readiness Pack
- Manual testing of the auth flow and tool injection paths
- Findings call with your engineers
- 7 to 10 business days
MCP Signoff audits are not penetration tests, compliance certifications, or guarantees of complete security. They are focused reviews of MCP configuration, exposed tools, risky permissions, governance evidence, and scan findings. MCP Signoff reviews only systems and materials the customer is authorized to submit for the agreed scope.
Know what your MCP setup can access and what to fix first.
Use the local scanner for a quick baseline, or purchase a fixed-scope audit when the MCP setup touches credentials, customer data, source code, databases, ticketing, or production-like systems.