Map the workflow
Document the trigger, current workaround, inputs, and acceptance criteria.
MCP SECURITY REVIEW · DEVELOPER B2B
Review your MCP server before customers connect real credentials.
A specialist preflight for authorization, tool risk, human approvals, protocol compatibility, and credential isolation—with a written retest instead of a generic scanner score.
Currently: research preview · synthetic data · no customer claims
RESEARCH PREVIEWSYNTHETIC
Synthetic MCP preflight findings
Token audience validationMissingHIGH
Delete-record toolNo approval gateREVIEW
Protocol revision2025-eraMIGRATE
Decision support, not a decision.→
01 / THE TRIGGER
A SaaS or platform team is preparing an MCP server for external users, but authorization behavior, tool scopes, risky actions, and protocol changes have not received a focused independent review.
Developers piece together changing protocol guidance, OAuth requirements, threat models, and client-specific behavior while security teams lack an MCP-specific review checklist and reproducible evidence.
02 / SAMPLE OUTPUT
A useful answer before a sales form.
This preview shows the shape of the output with synthetic inputs. Nothing here is personalized advice or production evidence.
RESEARCH PREVIEWSYNTHETIC
Synthetic MCP preflight findings
Token audience validationMissingHIGH
Delete-record toolNo approval gateREVIEW
Protocol revision2025-eraMIGRATE
Decision support, not a decision.→
03 / HOW A PILOT WORKS
Test a narrow output
Use synthetic or explicitly approved sample data in a scoped report.
Decide with evidence
Continue only if the workflow helps and a buyer makes a commercial commitment.
04 / FIT
Built for a narrow buyer.
Worth a conversation if you are…
✓ SaaS teams publishing authenticated MCP servers
✓ AI consultancies delivering agent integrations
✓ Security and platform teams preparing an MCP deployment
Not the right fit for…
— A compliance certification or penetration-test replacement
— Review of systems without owner authorization
— Guarantees against prompt injection or credential compromise
05 / FOUNDING OFFER
A founding review of one authorized MCP server: protocol and auth preflight, risky-tool inventory, reproducible findings, remediation call, and one focused retest.
06 / WHAT IS TRUE TODAY
MCP Preflight is a validation-stage specialist review, not a certification, warranty, or substitute for a full security assessment.
The public form accepts no endpoints, repositories, tokens, credentials, customer information, or vulnerability details.
Testing begins only after written authorization, agreed boundaries, safe test credentials, and disclosure procedures are documented.
07 / STRAIGHT ANSWERS
Questions this test must answer.
Is this a penetration test?+
No. The founding scope is a focused design and behavior review of MCP authorization, tools, approvals, and protocol compatibility.
Will you test a production endpoint?+
Only if explicitly authorized and safely scoped. A staging environment with dedicated test credentials is preferred.
What does the retest cover?+
One verification pass on the agreed high-priority findings after remediation.
08 / YOUR SIGNAL
Choose the commitment that matches your intent.
We use these details to separate useful buyer evidence from general curiosity.