Services

Focused testing, done by hand.

Our main work is auditing AI agents and MCP servers. We also run classic pentests for the rest of your stack, with the same contract terms, the same retest and published starting prices.

Book a scoping call All prices

Web app and API pentest Mobile app pentest Cloud security review Secure code review Agent Access Audit SOC 2 + AI Sprint

Start here

Our two main services.

Our main service

Agent Access Audit

An independent, signed-in test of what your MCP server or AI agent can really do, measured against what it needs, with the token, consent and prompt-injection paths around it. You get the fixes, a retest and a letter your customers can verify.

$2,900≈€2,600≈£2,200≈CA$4,100≈A$4,200≈S$3,700≈AED 10,700₹1,50,000per server

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Learn more

For compliance deadlines

SOC 2 + AI Pentest Sprint

A human-led pentest of one web app and its API, including any AI feature in it, with the report and letter your SOC 2 auditor asks for.

$3,400≈€3,000≈£2,600≈CA$4,800≈A$4,900≈S$4,400≈AED 12,500₹95,000

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Learn more

Also available

Classic pentests, fixed after scoping.

Starting prices are for a small, single application or account. You get one fixed price after a free scoping call.

Web app and API pentest

Manual testing of a web application and its API for authentication, access control and business-logic flaws.

OWASP Top 10 and API Top 10
Multi-tenant isolation
OAuth, OIDC, SAML, JWT

from$2,500≈€2,200≈£1,900≈CA$3,600≈A$3,600≈S$3,200≈AED 9,200₹75,000

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Mobile app pentest

iOS or Android app and the API behind it, tested against the OWASP Mobile Application Security standard.

OWASP MASVS / MASTG
Local storage and secrets
Certificate pinning and API abuse

from$2,200≈€2,000≈£1,700≈CA$3,100≈A$3,200≈S$2,800≈AED 8,100₹65,000per platform

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Cloud security review

AWS, GCP or Azure configuration, IAM and network exposure, reviewed by hand with read-only access.

IAM and privilege paths
Public exposure and secrets
Logging and guardrails

from$1,800≈€1,600≈£1,400≈CA$2,600≈A$2,600≈S$2,300≈AED 6,600₹55,000per account

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Secure code review

A focused review of the code that matters most: authentication, authorization, payments, file handling.

Auth and access-control paths
Injection and deserialization
Dependency risks

from$3,000≈€2,700≈£2,300≈CA$4,300≈A$4,300≈S$3,800≈AED 11,000₹85,000per repository

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Also on request: network testing, red team exercises, security advisory. Every engagement includes one retest of your fixes.

How we work

The same six promises on every job.

Signed authorization first
No testing of any system until a client representative has signed a written authorization and rules of engagement.
Staging before production
We test in staging or with test tenants. Production testing only with written approval and agreed limits.
Your data stays out of AI tools
Client data is never sent to third-party AI services without written consent. When AI helps, it runs on zero-retention API terms.
Deleted after 30 days
Working data is deleted 30 days after you accept the report, and you get a deletion certificate.
Fixed price, retest included
One price agreed up front. One retest within 30 days is part of it, not an upsell.
Public methodology
All 32 checks are published, with the standards they map to. You know exactly what you're buying.

Not sure which one you need?

Tell us what you're building and what's driving the test: a customer, an audit, a launch. We'll recommend the smallest test that answers the question.

Book a 30-minute call hello@subcloak.com

Focused testing, done by hand.

Our two main services.

Agent Access Audit

SOC 2 + AI Pentest Sprint

Classic pentests, fixed after scoping.

Web app and API pentest

Mobile app pentest

Cloud security review

Secure code review

The same six promises on every job.

Signed authorization first

Staging before production

Your data stays out of AI tools

Deleted after 30 days

Fixed price, retest included

Public methodology

Not sure which one you need?