# Subcloak

> Subcloak measures what your MCP server or AI agent is allowed to do against what it actually needs, then helps you fix the gap. Fixed prices, a retest, and an attestation letter your customers can verify.

Subcloak is a small, founder-led security practice based in India that works with SaaS and AI companies worldwide.

Prices are in USD for clients worldwide and in INR (plus 18% GST) for clients in India, with an India edition of the priced pages at https://subcloak.com/in. Other currencies shown on the site are estimates; clients outside India are billed in USD.

## Services
- [Agent Access Audit](https://subcloak.com/agent-access-audit): independent, signed-in least-privilege audit of an MCP server or AI agent. 32 published checks, scope map, least-privilege score, fix list, one retest, attestation letter. $2,900 (₹1,50,000 in India) per server; up to 4 servers $6,500. 7–10 working days.
- [Scope Snapshot](https://subcloak.com/pricing#snapshot): 2 days of signed-in testing of one server's scope and token enforcement. $490 (₹25,000 in India), credited toward a full audit.
- [Subcloak Watch](https://subcloak.com/pricing#watch): monthly re-checks after an audit. $900 (₹40,000 in India) per month.
- [SOC 2 + AI Pentest Sprint](https://subcloak.com/soc2-ai-pentest): manual pentest of one web app, its API and AI features, mapped to SOC 2 and ISO 27001. $3,400 (₹95,000 in India).
- [Web app and API pentest](https://subcloak.com/services#web-api): from $2,500 (₹75,000 in India).
- [Mobile app pentest](https://subcloak.com/services#mobile): from $2,200 (₹65,000 in India) per platform.
- [Cloud security review](https://subcloak.com/services#cloud): from $1,800 (₹55,000 in India) per account.
- [Secure code review](https://subcloak.com/services#code): from $3,000 (₹85,000 in India) per repository.

## Apps
- [Cloak Proxy](https://subcloak.com/apps/cloak-proxy): native macOS HTTP/HTTPS debugging proxy with a built-in API client. SSL Proxying per app or domain, breakpoints, Map Local, Map Remote, scripting, network conditions, capture of apps that bypass the macOS proxy, Insights, and an MCP server with 82 tools so AI assistants can drive it. Free for life. macOS 14 or later (Apple silicon and Intel); iOS, Windows, Linux and Android are coming. Full documentation: https://docs.subcloak.com/cloak-proxy/

## Free tools
- [Free MCP server check](https://subcloak.com/check): paste an MCP server URL to see what a connected AI agent gets by default, checked against the MCP spec. Public metadata only.

## Proof
- [Methodology: the 32 checks](https://subcloak.com/agent-access-audit/methodology)
- [Sample report](https://subcloak.com/sample-report)
- [Verify an attestation letter](https://subcloak.com/verify)
- [Research](https://subcloak.com/research)

## Contact
- [Book a 30-minute call](https://subcloak.com/book)
- Email: hello@subcloak.com
- [Security and disclosure policy](https://subcloak.com/security)