MCP security audit and MCP server security review

• Authentication

  We review how a caller proves who it is on each transport, how a session is bound to that caller, and which tools that identity may invoke. That is ASI03 Identity and Privilege Abuse.

• Tool definitions

  We review each tool's name, description, and schema, and what the handler does with an argument. A description or a result is text the model will read, so we review whether it can replace the caller's task. That is ASI01 Goal Hijack, LLM01 Prompt Injection, ASI02 Tool Misuse, and LLM06 Excessive Agency.

• Input validation

  We treat tool arguments as untrusted model output. We review whether they are checked before they reach a shell, eval, a template, a file path, or a query. That is LLM05 Improper Output Handling and ASI05 Unexpected Code Execution.

• Egress

  We review where the server sends data: which hosts, which credentials travel with the request, and whether a tool argument can choose the destination. Data leaving the server is LLM02 Sensitive Information Disclosure.

• Secrets

  We review where tokens, keys, and connection strings live, which tool can read them, and whether a response or a log can return them. That is ASI03 Identity and Privilege Abuse and LLM02 Sensitive Information Disclosure.

• Tenant isolation

  We review whether one tenant's token, file, or session can reach another tenant's tools or data. That is ASI03 Identity and Privilege Abuse.

Check our work before you send code

• Published reports
• Report format and severity
• Methodology
• Terms of engagement
• Responsible disclosure
• security.txt

How every finding is graded

• Critical

  Funds or safety, exploitable as scoped.

• High

  Serious, less immediate than critical.

• Medium

  Bounded loss or a broken assumption that does not yet have an exploit path in scope.

• Low

  Defense in depth.

• Informational

  An observation with no security impact as scoped.

Questions about MCP security audits

• What does an MCP security audit cover?

  Authentication, tool definitions, input validation, egress, secrets, and tenant isolation on the server a model calls.

• What is an MCP server security review?

  The same review. Model Context Protocol (MCP) is the interface a model uses to call a tool server. An MCP server security review reads that server: who can call it, what each tool does, and what data can leave.

• Which OWASP risks does this review cover?

  From the OWASP Top 10 for Agentic Applications: ASI01 Goal Hijack, ASI02 Tool Misuse, ASI03 Identity and Privilege Abuse, and ASI05 Unexpected Code Execution. From the OWASP Top 10 for LLM Applications: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM05 Improper Output Handling, and LLM06 Excessive Agency. The section above names which part of the server each id refers to.

• How is this different from an AI agent security audit?

  An AI agent security audit follows the agent loop, the tools, the MCP servers, the memory, the credentials, and the model loading. This review stays on the MCP server. If the agent around the server is also in scope, that is the other review.

• How is the quote set?

  The quote is fixed after we read the scope. We do not publish a starting price for this review. Smart contract audits publish a starting price on their page.

• What published reports can I read?

  Four published AI security audits: NVIDIA garak's Python package detector, vLLM's translation file field, image URL loading in mistral-common, and a shell breakout in a Baseten Truss image build. They are audits of AI tooling and inference code. Each one names the commit, the path, and the fix.