Cybersecurity
MCP security assessment
MCP makes it easy to connect assistants to tools and data. That convenience is also an attack surface. We review the servers you run, the ones you install and how clients decide what to trust.
The problem this service solves
An MCP server describes tools to a model and runs them on request. A badly designed server may expose a shell, file system or database with no authorization. A hostile or compromised server can embed instructions in tool descriptions or results to steer the model. Local servers run on a developer’s machine with that developer’s permissions.
Teams are adopting MCP quickly, often by installing community servers with a single command. We help you build or select servers with defined permissions, review them for common flaws and set policy for what your users can install.
What is in scope
-
Tool design
Scope of each tool, parameter validation and whether tools allow arbitrary commands, queries or file paths.
-
Authentication and authorization
How callers are authenticated, whether user identity reaches back-end systems and whether tokens are passed through safely.
-
Injection paths
Command, SQL and path injection in tool implementations, and instruction injection through tool descriptions or results.
-
Server trust
Provenance, update behavior and review of third-party servers, including change of tool definitions after approval.
-
Local execution
Permissions of locally run servers, sandboxing and access to credentials and files.
-
Transport and network
Binding addresses, TLS, origin checks and exposure of local servers on the network.
-
Secrets and logging
Credential storage, redaction in logs and an audit trail of tool calls.
-
Governance
An allowlist, review process and inventory for MCP servers in use.
How the work runs
Inventory
Find what exists.
-
1
Server and client inventory
List servers in use or planned, who runs them and what they can reach.
Test
Review and attack.
-
2
Code and configuration review
Review tool implementations and deployment settings.
-
3
Dynamic testing
Call tools with hostile input and attempt authorization bypass.
-
4
Instruction-injection testing
Check how clients and models respond to hostile tool metadata and results.
Govern
Set policy.
-
5
Controls and policy
Recommend allowlists, permission scoping, sandboxing and review gates.
What you receive
- MCP inventory and risk ranking
- Findings with reproduction
- Server hardening guidance
- Policy for approving and running MCP servers
- Logging and monitoring recommendations
- Retest
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Server source code or packages in scope
- List of clients and hosts
- Description of back-end systems the servers reach
What this service is not
- A guarantee about third-party servers we did not review
- Custom MCP development (available separately)
What changes afterwards
- Servers run with the least privilege that works
- Users install only reviewed servers
- Tool calls are logged and attributable
Questions people ask
Is MCP insecure?
The protocol is a way to connect tools to models. Its security depends on how servers are built, who can call them and what the client trusts. The risks are the familiar ones, in a new place.
What is tool poisoning?
Hiding malicious instructions in a tool’s description or output so the model follows them. Controls include reviewing tool definitions, pinning versions and limiting what tools can do when instructions are followed.
Related
-
AI agent security
Review agents that plan and call tools: identity, tool permissions, approvals, memory, isolation and audit.
-
AI security architecture
Design the controls around AI features: gateways, identity, data boundaries, evaluation, monitoring and governance.
-
API penetration testing
Testing REST, GraphQL and internal APIs for broken authorization, tenant isolation failures, token weaknesses and business-logic abuse.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response