Fixed scope, fixed price, written report. No hourly billing, no mandatory calls: we work by email.

Why it matters

  • Many MCP servers ship without OAuth or proper input validation.
  • Most real MCP CVEs are classic web bugs (path traversal, SSRF, injection) plus MCP-specific ones (tool poisoning, prompt injection via tool output).
  • I maintain OpenOSINT, an MCP-native open-source framework (1.8k+ GitHub stars), and have handled and published security advisories on my own projects, including a CVSS 10.0 one (GHSA-cqr4-hcfp-m6m4, OpenOSINT). Others: GHSA-2wrv-jxxj-r2xc (OpenOSINT) and GHSA-cf8c-836f-mrwr (pompelmi).

Packages

Quick Review

$390

  • 1 MCP server, up to 10 tools
  • Source-code review only
  • Findings list with severity and fix guidance
  • Delivery: 3 business days

Pay 50% deposit ($195) Email me first

Most popular

Full Audit

$890

  • Up to 25 tools
  • Source review plus dynamic testing on a staging environment
  • Full report: executive summary, CVSS-scored findings, proof of concept, remediation
  • 1 re-test within 30 days
  • Delivery: 7 business days

Pay 50% deposit ($445) Email me first

Audit + Fixes

$1,690

  • Everything in Full Audit
  • I implement the fixes as pull requests
  • Re-test of the fixes
  • Delivery: 10 business days

Pay 50% deposit ($845) Email me first

Delivery times start once I’ve received your written authorization and access.

Prices in USD. The deposit is 50% at purchase; the other 50% is invoiced when I deliver the report.

What I cover

The method is mapped to the OWASP MCP Top 10 (a beta list), plus:

  • Authentication, authorization and token scopes
  • Secrets handling
  • Input validation
  • Path traversal
  • SSRF
  • Command and argument injection
  • Tool-description injection
  • Over-permissive tools
  • Logging and audit trail
  • Dependency and supply-chain risks

Process

  1. Email me with the scope, or pay the deposit directly. Either way I reply within one business day with a short scope questionnaire and the written authorization form.
  2. Written authorization. You confirm in writing which systems I may test, and pay the 50% deposit if you haven’t already.
  3. Review. Source review, and dynamic testing on staging for Full Audit and Audit + Fixes.
  4. Delivery. On delivery you receive the executive summary and the list of findings; the full report with proofs of concept is released once the balance is paid.
  5. Balance payment. I send a Stripe invoice for the remaining 50%, due within 7 days.
  6. Re-test. One re-test within 30 days (Full Audit and Audit + Fixes).

What I need from you

  • Read-only access to the repository.
  • A staging endpoint. Never production, unless you explicitly authorize it in writing.
  • Test credentials scoped to staging.

Limitations

  • No guarantee that no vulnerabilities remain.
  • I test only the systems listed in the written authorization.
  • No denial-of-service testing and no social engineering.

FAQ

Is this a certification? No. It is a written security review. It is not a certification and does not make you compliant with any standard.

Do you test production? Not by default. Only with explicit written authorization.

What do I get at the end? A written report. Quick Review: findings with severity and fix guidance. Full Audit and Audit + Fixes: executive summary, CVSS-scored findings, proof of concept and remediation steps.

Who owns the report? You do. I keep your code, credentials and data confidential and delete them at the end of the engagement.

What if my server has more tools than the tier allows? Email me and I’ll quote the scope in writing.

Services are for businesses only. See the Terms.