Assessments · Security
MCP server assessments
Leslie Kadenge · full reviews against the method, each one checkable against the source
Each of these runs one MCP server through the same two-tier method and writes up what it found — a worked example of exactly what a paid review produces. They're split deliberately: the ones on my own code show I find and fix real bugs; the ones on code I didn't write show the part that's the actual service — reading someone else's server and telling them, honestly, where it stands.
My own servers
Where I can be hardest, and show the bugs as well as the fixes.
sweep-mcp — a file-deletion serverStrong across the basics; the assessment shows a real path-handling bug it had (a symlink check that ran after the path resolved through the link), how it was caught, and the two-line fix with a test behind it.
Servers I didn't write
The actual job — reading code that isn't mine, generously and in good faith. Both are named only for what they do well, and everything is checkable against their public repos.
Vantage — cloud-cost managementThe best tool-annotation discipline I've found: 127 tools whose three safety hints are made non-optional by the type system, so forgetting one is a compile error.
Plane — project managementConformance tests that fail the build if a tool's safety annotations ever stop matching what it actually does — plus one design trade-off flagged for discussion, not fix.
MongoDB — databaseThe rare server that actually implements tier-two confirmation: an elicitation flow with a configurable list of tools that must be confirmed before they run, plus a read-only mode and 230+ tests.
Sentry — error monitoringA hosted server behind an OAuth approval dialog, with ~160 test files — one of the most thoroughly tested I've read.
Neon — serverless PostgresRead-only enforced through the OAuth scope, not a self-checked flag — a read-only token is never even offered the write tools.
Grafana — observabilityA read-only mode that removes write tools entirely, designed to sit on top of read-only datasource credentials — defense in depth done properly, in Go.
Elasticsearch — searchClean per-tool annotations in Rust, memory-safe by construction — with an honest note that test depth is the thinnest of the set.
A selection — these are the servers written up in full. The field notes cover the wider read of thirteen production servers, and more companies were screened than are published here.
Yours could be next.
A review reads the whole server and writes it up like these — a document you can forward to whoever asked who checked. How it works · lesliekadenge@gmail.com.
New assessments are added here as they're done. Each is offered in good faith and names a server only for what it does well; where something is worth improving, it's raised with the maintainer, not published as a gotcha.