9 checks
Identity and tokens
- Is a token for another service accepted?
- Is the user's token forwarded to other APIs?
- Can a malicious client reuse someone's consent?
Agent Access Audit
Prove your agent gets only what it needs.
An independent, signed-in test of what your MCP server or AI agent can really do, measured against what it needs, with the token, consent and prompt-injection paths around it. You get the fixes, a retest and a letter your customers can verify.
Check A2 · audience · A3 · no passthrough
live diagram- Price per server
- $2,900≈€2,600≈£2,200≈CA$4,100≈A$4,200≈S$3,700≈AED 10,700₹1,50,000
- 4 servers $6,500≈€5,800≈£4,900≈CA$9,200≈A$9,300≈S$8,300≈AED 23,900₹3,40,000
- Turnaround
- 7–10 days
- working days
- Included
- Retest + letter
- within 30 days
Who it's for
Teams that have to prove it.
SaaS companies whose customers, auditors or partners need proof of what their MCP server, agent or AI connector can do.
A customer is asking
Their security review wants to know what your AI connector can do. A third-party report answers it.
An auditor is asking
SOC 2 or ISO 27001 evidence for your AI features, mapped to the controls they test.
You publish an MCP server
Customers connect Claude, ChatGPT or Cursor to your product, and every connection gets a token.
You'd rather fix it first
Cut access before an incident, a directory review or a customer finds it.
The difference
What a free check, or an AI assistant, can't give you.
Anyone can read what your server asks for: our free check does it in ten seconds, and an assistant can read your code. An audit tests what your server actually lets each tool do, signed in, and gives you proof someone else will accept.
- 01
Tested signed in. Accounts in two tenants and every tool called, so we measure what each one can do, not what it advertises.
- 02
Measured against the field. Your least-privilege score next to the servers in our State of MCP Scopes study.
- 03
Fixed without breaking clients. A scope split and step-up flow that still works in Claude, ChatGPT and Cursor, then retested.
- 04
Signed by someone accountable. A report and a letter with an ID your customers can verify, from people who answer for the result.
Scope map · fernhill-crm-mcp
6 tools · OAuth scopes requested at install
Least-privilege score
45/ 100→ 100 after fixes
- Requested
- 11
- Used
- 7
- Needed
- 5
- Needed 4
- Kept with a reason 1
- Used, not needed 4
- Never used 2
contacts.read (Needed)deals.read (Needed)notes.write (Needed)files.read (Needed)offline_access (Kept with a reason)contacts.write (Used, not needed)contacts.pii.read (Used, not needed)files.write (Used, not needed)export.all (Used, not needed)deals.write (Never used)admin.users (Never used)
| Tool | Uses | Needs |
|---|---|---|
| search_ | contacts. | contacts. |
| get_ | contacts. | contacts. |
| add_ | contacts. | notes. |
| list_ | deals. | deals. |
| export_ | export. | reports. |
| sync_ | files. | files. |
What we check
Six areas. 32 checks.
A few of the questions each area answers.
See all 32 checks
MCP spec 2025-06-18 · 2025-11-25 · 2026-07-28
6 checks
Scopes and least privilege
- Which scopes are requested but never needed?
- Are there admin or wildcard scopes?
- Can one tenant reach another through a tool?
8 checks
Tool design and injection
- Can text in a document trigger a risky tool?
- Can a tool's description change after approval?
- Do delete, send and export ask first?
4 checks
Data exposure
- Do tools return more fields than needed?
- Can memory leak between users?
- Can the agent be tricked into sending data out?
2 checks
Logging and limits
- Is every tool call logged with who made it?
- Are there spend and rate limits, and an off switch?
3 checks
Supply chain
- Are servers pinned to known versions?
- Do code-running servers run in a sandbox?
How it runs
Day by day, about 30 hours of work.
Findings appear in your dashboard as soon as each one is confirmed. You don't wait for a final PDF.
- 01
Day 0 · 2 h
Scope and sign
A 30-minute call, then a fixed-price proposal within 24 hours. Testing starts only after the contract, rules of engagement and a signed authorization letter are in place.
- 02
Days 1–2 · 6 h
Inventory and scope map
We list every tool, connector and OAuth scope, then measure requested vs used vs needed permissions.
- 03
Days 3–5 · 9 h
Identity and token checks
Audience, passthrough, issuer, redirect and consent tests against your staging environment.
- 04
Days 6–7 · 7 h
Injection, data and logging
Prompt-injection paths into risky tools, data exposure, audit trail and limits.
- 05
Day 8 · 3 h
Readout
A call to walk through the fix list and the least-privilege score with your engineers.
- 06
Within 30 days · 3 h
Retest and letter
We retest your fixes, issue the attestation letter, and delete working data with a deletion certificate.
What you receive
Proof for your customers, fixes for your engineers.
Attestation letter
One page, with an ID your customers and auditors can verify online.
Report (PDF)
Summary, findings, framework mapping and method, written to hand to a security reviewer.
One retest
Within 30 days of the readout, so the letter reflects the fixed server.
Scope map
Requested, used and needed scopes per tool, measured signed in, and the scope list to ship.
Least-privilege score
Before and after fixes, next to the servers in our study.
Live dashboard
Findings with evidence and fixes, as they're confirmed.
What we need from you
Four things, then we start.
We never test anything we haven't been authorized in writing to test.
- 01
A signed statement of work, rules of engagement and authorization letter.
- 02
A staging URL for the server or agent, or a test tenant with agreed limits.
- 03
Two test accounts in two different tenants, so we can check isolation.
- 04
An engineer we can message during the test, and a time for the readout.
Price
Three ways in.
Start with the free check, or a two-day Snapshot if you want to see how we work. The Snapshot's price is credited in full toward the audit.
What the free check can't see
Scope Snapshot
Two days of signed-in testing on one MCP server or agent: is each tool held to its scope, is each token held to your server, and which three changes matter most.
$490≈€440≈£370≈CA$700≈A$700≈S$630≈AED 1,800₹25,000
Fixed price · billed in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
For clients in India · plus 18% GST
2 working days
- Signed-in test of scope enforcement on every tool
- Token audience and passthrough checks
- Your result benchmarked against our study
- Top three fixes, in writing
- Price credited in full toward an Agent Access Audit
Our main service
Agent Access Audit
An independent, signed-in test of what your MCP server or AI agent can really do, measured against what it needs, with the token, consent and prompt-injection paths around it. You get the fixes, a retest and a letter your customers can verify.
$2,900≈€2,600≈£2,200≈CA$4,100≈A$4,200≈S$3,700≈AED 10,700₹1,50,000per server
Fixed price · billed in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
For clients in India · plus 18% GST
Up to 4 servers: $6,500≈€5,800≈£4,900≈CA$9,200≈A$9,300≈S$8,300≈AED 23,900₹3,40,000
7–10 working days
- Signed-in testing with accounts in two tenants
- Requested vs used vs needed permissions for every tool
- 32 checks across tokens, scopes, tools, data, logging and supply chain
- Findings mapped to OWASP MCP and Agentic Top 10, SOC 2 and ISO 27001
- Fixes that keep Claude, ChatGPT and Cursor working, and one retest within 30 days
- Report and attestation letter your customers can verify online
After the audit
Subcloak Watch
Keeps the audit result true as you ship: we re-check scopes every month and re-test the risky paths every quarter.
$900≈€800≈£680≈CA$1,300≈A$1,300≈S$1,200≈AED 3,300₹40,000per month
Fixed price · billed in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
For clients in India · plus 18% GST
Billed monthly · covers your audited servers
- Monthly scope and tool-change scan
- Quarterly mini-test of new tools and auth changes
- Dashboard and attestation letter kept current
- Priority retest when you ship a fix
Why not check it ourselves with an AI assistant?
For a first look, do. Our free check reads what your server asks for in seconds, and an assistant can review your code. What neither gives you is a signed-in test of what each tool can really do, fixes that keep Claude, ChatGPT and Cursor working, and evidence your customers and auditors will accept. A self-check isn't independent; our report and letter are, and we answer for them.
What counts as one server?
One MCP server or agent with up to about 15 tools and one authorization setup. If you run more than that, we'll tell you on the scoping call before quoting.
We don't have an MCP server, just an agent. Does this apply?
Yes. The same questions apply to any agent that calls tools or APIs on a user's behalf: which permissions it holds, which it needs, and whether outside text can steer it.
What is the least-privilege score?
The share of granted permissions that the tools actually need, or that you keep with a written reason. 100 means every permission is justified. We report it before and after fixes.
What is the attestation letter?
A one-page letter stating what we tested, when, and the result after the retest. It has an ID your customers can check on our verify page.
Can we start smaller?
Yes. Run the free check first. The Scope Snapshot is two days of signed-in testing on one server at a fixed price, and its price is credited in full if you go on to a full audit.
Which version of the MCP spec do you test against?
The current revision (2026-07-28) and the two before it (2025-11-25 and 2025-06-18), because many servers in production still follow older revisions. We re-check the spec before every audit.
Find out what your agent can really do.
Thirty minutes, no slides. Tell us what your agent or app touches and when you need an answer. You'll have a fixed-price proposal within a working day.