MCP Server Security Audit
Fixed price. 48 hours. Every finding checked by hand.
If you publish an MCP server that other people's AI agents connect to, you are exposing tools that run on your infrastructure. I review that code for the problems that matter: server-side request forgery, command injection and leaked secrets.
What you get for 390 USD
- A static scan with my open-source scanner, then every finding checked by hand. You get only confirmed issues, each with the exact line, why it matters and how to fix it.
- A written report (PDF) within 48 hours of getting access to your repository.
- One free re-check of your fixes within 14 days.
See a sample report (PDF). The sample uses synthetic code, not a real client.
After paying, send read access to the repository (or a zip) to flovoice53@gmail.com. Refund if I cannot review your code.
What I do not promise
That no vulnerability exists. A code review finds what is in the code I read; it does not cover runtime behavior, dependencies or your hosting setup. Every report states exactly what was and was not covered.
About me
I run my own MCP servers in production, published on npm and the official MCP registry, and I scanned 36 public MCP servers while building the scanner, so I know how much of automated output is noise. The scanner is open source: gitlab.com/florin-builds/mcp-ssrf-scan.