Pricing

Fixed prices, published in full.

No day rates and no surprise invoices. The first look is free; you pay for what a free check can't do: signed-in testing, fixes, and proof your customers accept.

01 · Free · ten seconds

Free access check

Paste your MCP server's URL and see what a connected AI agent gets by default, checked against the MCP spec.

Free

Instant · no sign-up

What a connected agent gets by default
Scopes asked for at first sign-in
Spec checks from public metadata
Compared with the servers in our study

Details

02 · What the free check can't see

Scope Snapshot

Two days of signed-in testing on one MCP server or agent: is each tool held to its scope, is each token held to your server, and which three changes matter most.

$490≈€440≈£370≈CA$700≈A$700≈S$630≈AED 1,800₹25,000

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

2 working days

Signed-in test of scope enforcement on every tool
Token audience and passthrough checks
Your result benchmarked against our study
Top three fixes, in writing
Price credited in full toward an Agent Access Audit

Details

03 · Our main service

Agent Access Audit

An independent, signed-in test of what your MCP server or AI agent can really do, measured against what it needs, with the token, consent and prompt-injection paths around it. You get the fixes, a retest and a letter your customers can verify.

$2,900≈€2,600≈£2,200≈CA$4,100≈A$4,200≈S$3,700≈AED 10,700₹1,50,000per server

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Up to 4 servers: $6,500≈€5,800≈£4,900≈CA$9,200≈A$9,300≈S$8,300≈AED 23,900₹3,40,000

7–10 working days

Signed-in testing with accounts in two tenants
Requested vs used vs needed permissions for every tool
32 checks across tokens, scopes, tools, data, logging and supply chain
Findings mapped to OWASP MCP and Agentic Top 10, SOC 2 and ISO 27001
Fixes that keep Claude, ChatGPT and Cursor working, and one retest within 30 days
Report and attestation letter your customers can verify online

See what's included

04 · After the audit

Subcloak Watch

Keeps the audit result true as you ship: we re-check scopes every month and re-test the risky paths every quarter.

$900≈€800≈£680≈CA$1,300≈A$1,300≈S$1,200≈AED 3,300₹40,000per month

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Billed monthly · covers your audited servers

Monthly scope and tool-change scan
Quarterly mini-test of new tools and auth changes
Dashboard and attestation letter kept current
Priority retest when you ship a fix

Details

Founding clients. Our first two Agent Access Audit clients get 30% off in exchange for a named case study and a reference call. Open until 31 March 2027.

Ask about it

Compare

What each step includes.

Feature	Snapshot	Audit	Watch
Default access, benchmarked against our study	Included	Included	Included
Signed-in test of scope enforcement per tool	Included	Included	New tools
Token audience and passthrough checks	Included	Included	Quarterly
Fixes in writing	Top three	All	Included
All 32 checks, with consent and injection testing	Not included	Included	Quarterly
Fixes that keep every AI client working	Not included	Included	Included
Live findings dashboard	Not included	Included	Included
Retest of your fixes	Not included	One	Priority
Report and attestation letter	Not included	Included	Kept current

Compliance

When an auditor or a customer needs a pentest.

A human-led pentest of one web app and its API, including any AI feature in it, with the report and letter your SOC 2 auditor asks for.

For compliance deadlines

SOC 2 + AI Pentest Sprint

A human-led pentest of one web app and its API, including any AI feature in it, with the report and letter your SOC 2 auditor asks for.

$3,400≈€3,000≈£2,600≈CA$4,800≈A$4,900≈S$4,400≈AED 12,500₹95,000

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

10 working days · rush +40%

Manual test of one web app, its API, and its AI features
Findings mapped to SOC 2 and ISO 27001 controls
Report your auditor can accept, plus a fix list
One retest and an attestation letter

Details

Price list

Everything in one table.

Fixed prices in USD, exactly as invoiced.Shown in EUR as an estimate at 9 Oct 2026 rates. You're invoiced the USD price.Shown in GBP as an estimate at 9 Oct 2026 rates. You're invoiced the USD price.Shown in CAD as an estimate at 9 Oct 2026 rates. You're invoiced the USD price.Shown in AUD as an estimate at 9 Oct 2026 rates. You're invoiced the USD price.Shown in SGD as an estimate at 9 Oct 2026 rates. You're invoiced the USD price.Shown in AED as an estimate at 9 Oct 2026 rates. You're invoiced the USD price.Fixed prices in INR. GST at 18% is added to the invoice.

Subcloak price list
Service	Price	Unit
Scope Snapshot	$490≈€440≈£370≈CA$700≈A$700≈S$630≈AED 1,800₹25,000fixed	fixed
Agent Access Audit	$2,900≈€2,600≈£2,200≈CA$4,100≈A$4,200≈S$3,700≈AED 10,700₹1,50,000per server	per server
Agent Access Audit, up to 4 servers	$6,500≈€5,800≈£4,900≈CA$9,200≈A$9,300≈S$8,300≈AED 23,900₹3,40,000fixed	fixed
Subcloak Watch	$900≈€800≈£680≈CA$1,300≈A$1,300≈S$1,200≈AED 3,300₹40,000per month	per month
SOC 2 + AI Pentest Sprint	$3,400≈€3,000≈£2,600≈CA$4,800≈A$4,900≈S$4,400≈AED 12,500₹95,000fixed	fixed
Web app and API pentest	from $2,500≈€2,200≈£1,900≈CA$3,600≈A$3,600≈S$3,200≈AED 9,200₹75,000fixed	fixed
Mobile app pentest	from $2,200≈€2,000≈£1,700≈CA$3,100≈A$3,200≈S$2,800≈AED 8,100₹65,000per platform	per platform
Cloud security review	from $1,800≈€1,600≈£1,400≈CA$2,600≈A$2,600≈S$2,300≈AED 6,600₹55,000per account	per account
Secure code review	from $3,000≈€2,700≈£2,300≈CA$4,300≈A$4,300≈S$3,800≈AED 11,000₹85,000per repository	per repository
Scopegauge	Freeopen source	open source

Also on request: network testing, red team exercises, security advisory. Rush delivery is +40% when capacity allows.

Paying us

How invoicing works.

Fixed price agreed before work starts. No day rates.
50% when the statement of work is signed, 50% on delivery.
Paid in INR plus 18% GST. Payment is due within 45 days under the MSMED Act.Paid in USD by international bank transfer, with no tax added to the invoice.

Partners

White-label testing at 25–35% off list.

For vCISOs, SOC 2 readiness firms, consultancies and AI agencies.

Partner programme

FAQ

Pricing questions

Something else? Email hello@subcloak.com or book a call.

Why pay when we could check it ourselves?

Start free: the free check and an AI assistant will show you what your server asks for. You pay us for what they can't give you: a signed-in test of what each tool can really do, fixes that keep every client working, and a report and letter your customers and auditors accept because they come from someone independent.

Do you charge for scoping?

No. The 30-minute call and the written proposal are free, and the proposal states one fixed price.

What if the scope changes during the test?

We stop and agree any change in writing before doing extra work. Nothing is added to the invoice without your sign-off.

Is the retest really included?

Yes, one retest within 30 days of the readout. Subcloak Watch clients get priority retests whenever they ship a fix.

Do you offer discounts?

Our first two Agent Access Audit clients get 30% off in exchange for a named case study. Partners who resell our work get 25–35% off list. We don't run sales or haggle otherwise.

Find out what your agent can really do.

Thirty minutes, no slides. Tell us what your agent or app touches and when you need an answer. You'll have a fixed-price proposal within a working day.

Book a 30-minute call hello@subcloak.com