Someone should read your MCP server before your customer’s security team does.
A fixed-price review of your published MCP server or agent skill pack. In three business days you get the findings ranked by what an attacker actually gets, patch diffs for the top three, a regression test pack you keep, and one page you can paste straight into a customer’s security questionnaire.
One repo link in the email is enough to start. I reply with scope and price in writing before anything begins.
The problem, in four numbers
Of MCP servers that have been tested by researchers:
Sources: Equixly, Enkrypt AI, Zuplo and Gravitee, collected in Practical DevSecOps’ 2026 MCP security statistics.
The official MCP registry grew by 11,561 servers in 30 days — to 43,298 (source). Almost none of them have been read by anyone but their author.
Why a person, when the scanners are free
They are free, and they are good. I run one of them as part of this —
mcp-audit, Apache 2.0, 89 rules. You should run it
yourself tonight.
What it will not do is tell you which of its 40 findings actually matters for your server, hand you the diff, or give you a test that fails today and passes after the fix. That is the part a person does, and it is the part you are buying.
The other option is a full agent red-team engagement. Those are real and worth it at scale — and they start at around EUR 2,400 for a two-week single-agent sprint (example), running to $8,000–25,000 for a one-time audit (AI Vyuh, 2026).
This sits deliberately in between: one server, one person, three days, $600.
What you get
Findings ranked by blast radius, not by rule severity
File and line, what an attacker gets, and how hard it is to reach. Scanner noise is dropped before you see it, and I tell you what I dropped and why.
Patch diffs for the top three
Not “consider validating input.” An actual diff against your actual code.
A regression test pack you keep
Three to five cases that fail on your current code and pass after the fix, so the same bug cannot come back on a later release. Yours, in your repo, running in your CI after I’m gone.
One page for your customer
Plain English, no jargon, written to be pasted into a vendor security questionnaire. The reason most people buy this.
What is and is not included
So there is no argument later, here is the whole scope. Anything in the right-hand column is a different conversation and a different price, agreed in writing or not done at all.
Included in $600
- One MCP server, or one skill pack up to 15 skill files
- Static review of your public repository and published server
- A reproducible scan: free
mcp-auditplus my own skill-file scanner - A hand read of every tool definition, description, argument schema and instruction file — the part that is not automatable
- Findings ranked, with file and line, and the noise I discarded named
- Patch diffs for the top three findings
- Three to five regression tests, yours to keep
- A one-page plain-English summary for your customers
- One round of written follow-up questions after delivery
- Delivery in three business days from the agreed start
Not included
- No penetration test and no live exploitation of your production systems
- No access to your private code, infrastructure or customer data is needed, asked for or granted by default
- No credentials, no staging environment, no VPN
- No formal certification, attestation, SOC 2, ISO or compliance sign-off — I am not an accredited auditor and this report is not an audit opinion
- No fixes applied to your repository by me, and no pull requests opened unless you ask
- No review of your wider application, cloud account or dependencies beyond the server and its manifest
- No guarantee that a finding exists, and none that the review is exhaustive
- No ongoing monitoring unless you take the monthly re-scan
- No legal advice
Who I am
I run small, hand-built experiments on agent security and publish all of them, including the ones that went badly: github.com/jalil-dini/field-notes — seven demos, every one runnable on a laptop, with a CI badge that proves they still run.
Three that are relevant to your server:
- I scanned 300 public agent skill files. 45 of them, across 44 repositories, carried at least one flag worth a human look: 15 pre-approve shell access, 15 handle credentials, 9 POST data to an outside server, 4 pipe a download into a shell. Method and scanner.
- I broke a guardrail by renaming one option. Across four open models, renaming a decision gate’s allow option to “allowed by policy” let through 60–100% of pages that should have been blocked. Measurements.
- Then I fixed one, and measured the fix. On 48 hand-labelled pages, wrong form fills fell from 3 to 1, and from 2 to 1 on held-out pages, with no real result lost. That regression method is what goes into your test pack. Write-up.
I write about this at @agentwik.
I am not a security consultancy and I will not pretend to be one. I am one person who reads these systems carefully and shows his work.
Price
The same review, at a lower price, in exchange for a two-sentence quote I can attribute to you. Two of these, then it stops.
One MCP server, or one skill pack up to 15 files. Three business days. Everything above.
Up to five servers or packs, and I wire the regression pack into your CI.
I re-run the review on each release and report only on what changed. Cancel any time.
Scope and price are agreed in writing before I start, and they do not move. If the review turns up nothing worth fixing, you pay nothing and you keep the report.
jalildinia+harnesscheck@gmail.com
Questions people ask
Do I have to give you access to anything?
No. The standard review works entirely from your public repository and published server. If you want your private code or a staging endpoint reviewed, that is a conversation and a scope change, not the default.
Will you publish what you find?
Not without your written permission. I publish aggregate statistics with every name removed — the 300-file scan above names nobody. If I want to write up your case, I ask, and no is a complete answer.
Three days really?
For one server, yes. I take one at a time for exactly this reason. If I can’t make it, I tell you before you pay.
What if we already ran a scanner?
Good — send me the output. Reading someone else’s scan results and telling them which four of the forty matter is a normal way for this to start.
Are you going to find something?
Usually. On the research numbers above, most tested servers have something. If yours doesn’t, you pay nothing, and “an independent reviewer found nothing worth fixing” is itself a sentence worth having for your customers.
Is this a certification I can show an auditor?
No, and you should be suspicious of anyone selling you one at this price. It is a report written by a named person who read your code, which is the thing most vendor questionnaires are actually asking for. If your customer needs an accredited audit, you need a firm, not me.
Your MCP server is running inside other people’s agents.
Three days and $600 to know what it can be made to do.