Skip to content
Cognivators
All engagementsTaking clients
02 / MCP & AI agents

Your MCP server has an auth boundary. Has anyone outside the team read it?

A manual, five-day review of the door most teams have not checked: how your MCP server or agent registers clients, handles tokens, and decides what a tool call may do.

Start the MCP reviewAsk a question first

Fixed scope · 5 business days· scoped in writing first

What it costs to leave it

  1. Credentials leave the boundary

    A credential that isn't scoped to one host travels wherever the next request happens to go.

  2. Entitlements in the docs, not the code

    A scope the server never checks is one crafted request from a disclosure.

  3. Someone else finds it first

    A customer's security team, a bounty hunter, or nobody friendly at all.

How it gets closed

Exactly what
gets reviewed.

Four places where MCP auth actually fails, read at code level and tested against the running server.

MCP clientagent, IDE, or botREGISTERS, CALLS TOOLSYOUR MCP SERVERTHE AUTH BOUNDARY01Client registrationmetadata URL: validated, or trusted?02Token handlingissued, stored, attached to which hosts?03Tool-call scopeis the documented entitlement enforced?04Boundary and redactionenv, stdout, stderr, error messagesSCOPED CALLThe API you meantGitHub, your DB, a vendorTOKEN, UNSCOPED HOSTA host you did not meannot scoped to the intended destinationSECRET IN ENVChild process, logsenv, stdout, model contextintended pathleak path. The pattern behind the record below.
  1. 01

    Client registration

    Is metadata from a client-supplied URL validated, or just trusted?

  2. 02

    Token handling

    Issuance, lifetime, storage, and every path a token can leak past its scope.

  3. 03

    Tool-call scope

    Is the entitlement the docs promise enforced on every path, not only the happy one?

  4. 04

    Boundary and redaction

    Secrets in child processes, stdout, error messages, truncation edge cases.

Timeline

A fixed calendar.
No open-ended scope.

Standard turnaround · 5 business days

  1. Day 0

    Kickoff

    Repo access, Rules of Engagement signed, scope in writing.

  2. Day 1 to 4

    Manual review

    Code-level review, then testing against the running server.

  3. Day 5

    Report and call

    Severity, proof of concept, fix guidance, walkthrough.

  4. Within 60 days

    Free retest

    Confirms the fixes hold.

Public record

Same class of bug,
found in public.

Every row links to the vendor's own repository or advisory and names the author.

  1. Google

    CVE-2026-14540

    Server-side request forgery in the generic HTTP source and tool components of MCP Toolbox.

    Reported. Fixed by Google, credited by name.

    Fixed Jun 2026

  2. GitHub

    github-mcp-server #3056

    A redirect-following transport re-attached the GitHub token on every hop. Hardened so it's only attached to GitHub's own configured hosts.

    Patch authored here, merged upstream.

    Merged Aug 2026

  3. Weaviate

    PR #12961 · HackerOne

    Google module accepted an arbitrary apiEndpoint, a credential-exposure path.

    Confirmed. Fixed by Weaviate.

    Merged Sep 2026

  4. JPMorgan Chase

    jpmorgan-payments/ai #19

    One tool skipped the domain allowlist its sibling tool already enforced.

    Validated and fixed through JPMC Responsible Disclosure.

    Merged Sep 2026

  5. 1Password-MCP (community)

    GHSA-q3gg-rgxh-gh64

    op_run leaked the OP_SERVICE_ACCOUNT_TOKEN master credential to subprocesses and model context.

    Advisory published, credited by name.

    Source

What you get

Fixed scope.
Confirmed in writing.

MCP / AI Agent Security Review

  • A written report: every finding severity-rated, with a proof of concept and a fix
  • A 30 to 45 minute walkthrough call
  • One free retest within 60 days
Target
One MCP server or AI agent and its auth boundary
Turnaround
5 business days
Deliverable
Severity-rated report, proof of concept per finding, walkthrough call
Retest
One, free, within 60 days
Access
Read access to the repository. No production access

Priced after a short look at the system, confirmed in writing before anything is touched. Scope that grows is re-quoted first, never billed after.

Start the MCP review

Before you email

Anything else: ask it first. No scope is confirmed until it is answered.

02 / MCP & AI agents

Ready to find out what is actually there?

Start the MCP reviewCompare all three

Fixed scope · 5 business days

Replies come from the person doing the work, within one business day.