MCP production-readiness audits

Know what your agents can reach before a buyer asks.

MCPScan combines a local-first CLI with fixed-scope audit reports for teams connecting AI agents to internal tools, credentials, code, customer data, and third-party APIs.

Book an MCP audit View sample report

A-F security grade JSON, HTML, Markdown, and SARIF reports CI threshold support Governance-ready evidence

local scan

npx mcpscan scan ./claude_desktop_config.json --ci --min-grade B

Grade: C
Findings: 2 high, 3 medium, 1 low

HIGH AUTH-001
No authentication hints detected for filesystem-server

HIGH TOOL-001
Tool description contains prompt-injection language

30s typical local scan

A-F risk grade

0 default uploads

Purpose-built checks for MCP production risk.

MCPScan focuses on the access patterns that matter when agents can call real tools: authentication, sensitive outputs, network reach, dangerous tool descriptions, unsafe defaults, and the evidence a security reviewer expects to see.

Access and auth

Flag missing authentication signals, default credentials, broad CORS settings, and transport issues that make MCP endpoints too easy to reach.

Tooling exposure

Review tool names, descriptions, permission breadth, prompt-facing language, and shadow-tool patterns that can confuse agents or users.

Input and output risk

Detect SSRF, command-injection, path traversal, SQL-injection, sensitive data, excessive data, and error-disclosure patterns.

Evidence security and engineering can both use.

Every scan result is designed to move from finding to owner to fix, with evidence, business impact, remediation guidance, and a clear grade for release decisions, pilot reviews, and customer security conversations.

Sample report package

Share a sanitized report package with an executive summary, MCP server inventory, findings table, detailed evidence, remediation checklist, and out-of-scope notes.

Open sample report Compare audit options

No authentication hintsHigh
URL-fetching tool SSRF riskHigh
Prompt-injection tool copyMedium
Sensitive data pattern in outputMedium
TLS probe warningLow

Fixed-scope MCP readiness audits.

Start with the free local scan, then buy a focused manual review when MCP servers touch sensitive systems, enterprise-facing demos, pilots, or customer security questionnaires.

MCP Quick Audit

For one MCP setup that needs a fast readiness readout.

$750fixed scope

Up to 3 MCP servers
1 environment
Written report
3 business day turnaround

Purchase Quick Audit

MCP Launch Audit

For startups preparing pilots, demos, or early customer security review.

$1,500fixed scope

Up to 8 MCP servers
2 environments
Report and findings call
1 re-scan after fixes

Purchase Launch Audit

Enterprise Readiness

For teams preparing a deeper governance, security, or buyer review.

$3,500fixed scope

Up to 15 MCP servers
3 environments
Executive summary
Findings call and 1 re-scan

Purchase Enterprise Audit

MCPScan audits are not penetration tests, compliance certifications, or guarantees of complete security. They are focused reviews of MCP configuration, exposed tools, risky permissions, governance evidence, and scan findings.

Know what your MCP setup can access and what to fix first.

Use the local scanner for a quick baseline, or purchase a fixed-scope audit when the MCP setup touches credentials, customer data, source code, databases, ticketing, or production-like systems.

Buy an audit Ask about scope