Methodology · updated 10 Oct 2026
Every audit runs the same checks in six areas. Each finding in your report links back to one of them, with the standards it relates to. We publish the list so you know exactly what you're buying.
Who is calling, with which token, issued by whom, for what.
A1
The server publishes protected-resource metadata that points to the right authorization server, and discovery doesn't expose internal hosts.
A2
Tokens are accepted only if they were issued for this server. Tokens for other services are rejected.
A3
The server never forwards the client's token to other APIs. It uses its own credentials or a token exchange.
A4
A proxy server with one static client ID asks each user to consent per client, so a malicious client can't reuse someone else's consent.
A5
Client metadata documents, any dynamic registration and redirect URIs are matched exactly, and metadata fetches can't be turned into SSRF.
A6
Clients and servers check the issuer of tokens and authorization responses, which blocks authorization-server mix-up attacks.
A7
Access tokens are short-lived. Refresh tokens rotate, are kept confidential, and can be revoked.
A8
Session IDs or state handles are random, bound to the user, and never treated as proof of who is calling.
A9
Each agent and server has its own identity, and secrets live in a vault rather than in config files, prompts or environment dumps.
What each tool is allowed to do versus what it needs.
B1
For every tool we measure the permissions it asks for, the ones it uses and the ones it needs. This produces the scope map and the least-privilege score.
B2
No wildcard, admin or "full access" scopes where a narrower scope would do the job.
B3
Riskier actions ask for extra scope or approval when they are first needed, not all at once at install.
B4
Each tool checks that this user may act on this specific record, not just that they are signed in.
B5
A user in one customer account can't read or change another account's data through any tool.
B6
You know every MCP server and connector your agents can reach, and unknown servers are blocked.
Whether text from the outside world can steer tools.
C1
Tool names and descriptions contain no hidden instructions, and descriptions from third-party servers are reviewed before use.
C2
Tool definitions are versioned. A change after users approved them is announced and approved again.
C3
No two connected servers expose tools with names that could be confused, so one server can't hijack calls meant for another.
C4
Text from documents, tickets, emails or web pages can't make the agent call a risky tool.
C5
Tool handlers are tested for command injection, SQL injection, path traversal and server-side request forgery.
C6
Destructive or bulk actions such as delete, send, pay and export need an explicit confirmation from the user.
C7
Local servers bind to localhost, validate the Origin header and resist DNS rebinding.
C8
When one agent calls another, each one checks what the caller is allowed to ask for and doesn't pass its own token along.
What data leaves the server, and where it can end up.
D1
Tool responses include only the fields the task needs, not whole records with personal data.
D2
Memory, caches and retrieval indexes are separated per user and per tenant.
D3
The agent can't be tricked into sending data out through links, images, files or outbound tools.
D4
System prompts, tool configuration and keys can't be read back by users or other tools.
Whether you can see, limit and stop what agents do.
E1
Every tool call is logged with the user, client, tool, arguments and result size, and logs can't be edited by the agent.
E2
Rate limits, spend limits and alerts are in place, and you can switch an agent off quickly.
Where servers come from and how they're isolated.
F1
Servers and packages come from known sources at pinned versions, so a silent update can't change behaviour.
F2
Servers that run code or touch files run in a sandbox with the least operating-system and network access they need.
F3
Custom servers get static analysis and dependency checks, with findings tracked to a fix.
No checks match that search.
Thirty minutes, no slides. Tell us what your agent or app touches and when you need an answer. You'll have a fixed-price proposal within a working day.