An MCP server gives AI agents a direct line into your systems. If a tool is over-permissioned, if a token is passed through, or if a tool description can be poisoned, an attacker does not need to break your API; they only need to talk to the agent. The Codersarts MCP security audit tests your MCP servers the way attackers and misbehaving agents use them, and gives you a prioritized fix list, at a fixed price with a free retest.

What Is an MCP Security Audit?

A standard web penetration test looks at endpoints and forms. An MCP audit adds the agent layer: what the model can be tricked into calling, what a tool description can make it do, and what data leaves your system through tool results. Both are useful, but they are not the same test.

MCP Security Audit at a Glance

Why MCP Servers Need Their Own Security Review

MCP adoption has moved faster than MCP security practice. Public scans of community servers repeatedly find the same weaknesses: static API keys, tools with far more access than they need, missing input validation and no logging. Even well-built servers face risks that do not exist in a normal API:

• The caller is a language model. It follows instructions it finds in data, so a malicious document, ticket or web page can steer it into calling your tools.

• Tool descriptions are code. A changed description can quietly alter what an agent does, which is why rug pull and tool poisoning attacks exist.

• Permissions stack up. An agent connected to several servers can chain a harmless read tool on one server with a write tool on another.

• Tokens travel. Servers that forward a user's token to downstream services create confused deputy problems that are hard to spot in code review.

When Should You Get an MCP Security Audit?

• Before launch of a public MCP server, ChatGPT app or Claude connector

• Before directory submission or an enterprise customer's security review

• After a major change, such as new write tools, a new auth provider or the move to the stateless 2026-07-28 specification

• Before adopting a third-party MCP server inside your company

• As part of SOC 2, ISO 27001 or customer due diligence where AI integrations are in scope

What We Test in an MCP Security Audit

Authentication and authorization

We review the OAuth 2.1 flow, PKCE, token audience and expiry, Protected Resource Metadata, client registration, and whether tokens are ever passed through to downstream APIs. We test what happens with expired, replayed, stolen and wrong-audience tokens.

Tool permissions and least privilege

We list every tool, map what it can read and change, and check whether scopes match the real risk. We look for write and delete tools without confirmation, admin functions exposed to normal users, and tools that can be chained to escalate privileges.

Tool poisoning, rug pull and tool shadowing

We check whether tool names and descriptions can be altered after approval, whether they contain hidden instructions, and whether a malicious server connected to the same client could shadow or override your tools.

Prompt injection through tool results

We plant attacker-controlled text in the data your tools return, such as tickets, comments, file contents or web pages, and test whether connected AI clients can be steered into unsafe calls or data disclosure.

Input validation and injection

We test tool arguments for command injection, SQL and NoSQL injection, path traversal, server-side request forgery (SSRF) and unsafe file handling.

Tenant isolation and data exposure

For multi-tenant servers, we attempt to read or change another tenant's data through every tool, including search, export and bulk operations. We also check whether responses leak secrets, internal IDs, stack traces or personal data beyond what the user needs.

Transport, session and hosting

We review TLS, Origin header validation, CORS, session handling, rate limits, resource limits and how the server is exposed to the internet. For local servers we check file system and network access on the user's machine.

Supply chain

We review dependencies, SDK versions, package publishing and signing, container images and CI secrets, and check for known vulnerabilities and typosquatting risks.

Logging and detection

We check whether tool calls are logged with enough detail to investigate an incident, and whether sensitive values are redacted in those logs.

OWASP MCP Top 10 Coverage

MCP Security Audit vs Standard Penetration Test vs Automated Scanner

Example Attack Scenario (Illustrative)

The scenario below is illustrative and shows why agent-layer testing matters.

A helpdesk SaaS ships an MCP server with two tools: one that reads support tickets and one that sends email replies. A customer connects it to their AI assistant. An attacker submits a support ticket containing hidden text that tells the assistant to search for recent invoices and email them to an outside address. When the support agent later asks the assistant to "summarize today's tickets", the model reads the poisoned ticket and follows the instruction, using both tools exactly as designed.

No endpoint was broken. Every call was authenticated. A standard pentest would pass this server. An MCP audit flags it through three findings: untrusted ticket content returned without labelling, a write tool with no confirmation step, and no restriction on outbound email recipients.

Most Common MCP Security Findings

• Static API keys shared across all users instead of per-user OAuth

• Over-broad scopes, where one token can read and change everything

• Token passthrough to downstream services, creating confused deputy risk

• Write tools without confirmation, such as delete, send or pay

• URL fetch tools that can reach internal networks or cloud metadata

• Untrusted content returned to the model with no labelling or size limits

• Missing tenant checks on search, export and bulk tools

• Verbose errors that leak stack traces, internal IDs or secrets

• No audit trail of which user called which tool with which arguments

How Much Does an MCP Security Audit Cost?

Specialist security firms typically quote several thousand dollars for a single MCP server. Codersarts offers fixed prices sized to tool count and complexity, with a free retest.

Every package includes the findings report, a 60-minute walkthrough call with your engineers and one retest within 30 days. Durations are illustrative and confirmed during scoping.

How the Audit Works

1. Scoping call. We confirm servers, tools, environments, access and rules of engagement, and send a fixed quote.

2. Access setup. You provide staging access, test accounts in at least two tenants, and read access to the source repository.

3. Threat mapping. We map every tool, data flow and trust boundary, and agree which attacks matter most for your business.

4. Testing. We combine source review, manual testing and attacks through real AI clients such as ChatGPT, Claude and Cursor.

5. Reporting. You receive a report with each finding rated critical, high, medium or low, with evidence, impact and fix steps.

6. Walkthrough and retest. We walk your team through the results, then retest fixed items and issue an updated report.

What You Receive

• Executive summary for leadership and customers' security teams

• Detailed findings with severity, affected tools, reproduction steps and screenshots

• Fix guidance written for your stack, with example code where useful

• Tool permission map showing what every tool can read and change

• Hardening checklist for future tools your team adds

• Retest letter confirming which findings are resolved

What We Need From You

• A staging environment that mirrors production

• Test accounts in at least two tenants with sample data

• Read access to the server's source code and dependency files

• A technical contact available during testing

• Written authorization for the agreed scope

Why Codersarts for Your MCP Security Audit

• We build MCP servers too. Our engineers build production MCP servers and AI agents, so fixes are practical, not theoretical.

• Agent-layer testing. We test what AI clients actually do with your tools, not only what the API returns.

• Fixed price and free retest. You know the full cost up front.

• Fast turnaround. Most single-server audits finish within a working week.

• Fix support available. If you want help with remediation, our team can fix findings for you or guide your developers.

• Confidential by default. We sign an NDA before access, and findings are shared only with your named contacts.

For broader reviews of code written with AI tools, see our AI-Generated Code Audit. To build a secure server from the start, see SaaS MCP Server.

Frequently Asked Questions

Find the Gaps Before an Agent Does

Every new tool you add to an MCP server is a new way into your systems. A focused, independent audit tells you exactly where you stand and what to fix first. Share the server URL or repository and the number of tools, and we will send a fixed quote.