The challenge behind the engagement.
Model Context Protocol (MCP) servers give an AI assistant tools and data access. This assessment covers the servers you build or host and the third-party servers your developers connect, tested against the current protocol specification. Where the server requires sign-in, we check that it proves who it is, accepts only tokens meant for it, and never passes a user's token unchanged. We test servers that front other services for mistaken-authority flaws, craft tools whose descriptions or results hide malicious instructions, and try to make the server reach internal addresses. We check whether each call runs as the user or the server. You receive a requirements checklist, a tool-by-tool table, and fixes by component. We report the controls tested and the limits of the assessment; the report is not a protocol certification.
For platform teams exposing internal systems to AI assistants through a connector, and for security teams asked to approve the third-party servers developers install in their tools. Commission it before an internal server goes past a pilot, or after adopting a newer version of the protocol.
What we do.
What you can use.
Collect manifests, config, and clients
We ask for the server's source, or at least the list of tools it offers and how sign-in is configured, plus the sign-in service it relies on. We also need the credentials the server holds for the systems behind it and the assistants that connect to it, since older ones behave differently. A test deployment with accounts in two roles sets the depth.
Test sign-in, tools, and transport
We present tokens meant for another service, replay old sign-in codes, and pass a user's token through the server to see what the systems behind it accept. We register tools whose descriptions hide instructions, change a tool's behavior after approval, guess the handles that track a session, and aim the server at internal addresses. We also review how the gateway decides what to allow.
Report conformance and fixes by component
You receive a checklist of the specification's requirements and recommendations, each marked pass, fail, or not applicable, a tool-by-tool table of credential, identity model, reversibility, and approval, and findings with reproduction. Fixes are assigned to the server, the sign-in service, the assistant, or the gateway, then retested once your changes land.
Who it’s for.
When you need it.
- Platform teams exposing internal APIs or data to AI clients through an MCP server
- Organizations hosting an MCP server that wraps a backend using shared credentials
- Security teams asked to approve third-party MCP servers developers want to install
- Teams that recently adopted or upgraded to a newer MCP protocol revision
- An internal MCP server is about to move beyond a pilot to real users
- Developers are requesting third-party MCP servers you have not reviewed
- You migrated to a newer MCP revision and changed how authorization works
- One MCP server holds upstream credentials broader than any single tool needs
What the scope can include.
- 01
Sign-in conformance: proving identity, accepting only tokens meant for the server, and validating them
- 02
Mistaken-authority flaws in servers that sit in front of other services
- 03
Hidden malicious tools introduced through tool descriptions, inputs, or returned results
- 04
How broad the server's stored credentials are, and whether calls run as the user or the server
- 05
Guessable session handles, servers reaching internal addresses, and exposure of locally run servers
- 06
Origin, least privilege, and human approval for the third-party servers you connect
What it typically costs.
One rate: $150/hour.
Every engagement is priced by the hours it takes at one flat rate, with scoping, the work, and reporting, plus a retest of your fixes, included. Find the size closest to yours.
One connector server with fewer than ten tools
About 24–40 hoursTwo to five connector servers, or one that signs users in and fronts an internal system
About 48–80 hoursFive or more servers serving multiple customers, plus review of outside servers your developers use
About 96–150 hours- Number of connector servers and tools they expose
- Whether the server signs users in, and how
- How much access the server's stored credentials carry to systems behind it
- Whether servers are shared across customers or teams
Ranges are planning estimates at $150/hour, not a quote. Your price is confirmed in writing after a scoping call, before any work begins.
What you take forward.
- Conformance checklist against the current specification, itemized by requirement and recommendation with results
- Tool-by-tool table of stored credential, identity model, reversibility, and human approval requirement
- Findings with reproduction: crafted tool descriptions, mismatched tokens, and sign-in redirect abuse
- Fixes assigned to server, sign-in service, assistant, or gateway, then confirmed at retest
Final coverage, deliverables, timing, and any retesting or implementation work are confirmed before the engagement begins.
Before we get started.
Do we need a sign-in flow for a server that runs locally?
Not usually. The specification says a locally run server should take its credentials from the environment rather than use the web sign-in flow, so we do not fault it for lacking one. We test what does matter there: how broad the credential the server reads is, and whether the command that installs it can be tampered with. We also check whether the process is contained and whether a local network version is reachable by other software on the machine. If the server is later exposed over the network, the sign-in checklist applies.
Our server wraps an internal system with one shared account; what could go wrong?
A single shared account means every user of the server acts with the same permissions behind it, and the server becomes something an attacker can trick into acting for the wrong person. We test whether a crafted tool input, a hidden instruction in a tool description, or a mismatched token can make that account act for a user who should not have the access. We also review what the account can reach beyond the tools' stated purpose. The report shows the real reach and recommends per-user access or a narrower account where it applies.
- OWASP GenAI LLM Top 10 2026
- OWASP Top 10 for Agentic Applications for 2026
- GenAI Red Teaming Guide
- MITRE ATLAS
- NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
- Model Context Protocol Specification: Authorization (2026-07-28)
- Document-Level Access Control - Azure AI Search