MCP & AI-agent security
An MCP server gives an AI model the keys to something real — a database, a filesystem, a cloud account, a web session. I read those servers and tell you, with a test behind every finding, whether the keys can be misused. The result is a document you can forward to whoever asked: an enterprise customer's security team, a compliance reviewer, a partner's vendor questionnaire.
Most funded companies' servers are now designed well. Almost none can independently show it — their own tests prove their own assumptions. That gap, between a safety property you assert and one someone has verified, is the work.
What I do
Review · $550–2,000 — you have a server; I read the whole thing and write up what I find, each finding with a test. Fixed price, about a week.
Remediate · from $2,200 — I don't just find the gaps, I close them: tool annotations, confirmation before destructive actions, re-validation, defense in depth — each with a test behind it, so your server leaves the review fixed, not just diagnosed.
Verify · $550–2,000 — your server is already good; I produce the independent write-up that proves it, for the customer or auditor who's asking who checked.
Build · from $6,000 — you have a product and no server yet; I build one properly — annotations, an access model, guardrails, tests, CI — from day one.
Fixed price, agreed before I start — never hourly. The range depends on the number of tools the server exposes and what they reach.
How it works
1. Send me the server. A link to the repository (or read access), and a line on who is asking you for proof — a customer, an auditor, or nobody yet.
2. A fixed quote. Within two working days I reply with a price, a date and exactly what you get. Nothing starts until you agree to it, and payment is by PayPal invoice sent with the quote.
3. The report. A written document you can forward, each finding with a test behind it, usually within about a week.
The work, in the open
Everything below is checkable. That's the point — a review is only worth something if you can see what it looked for.
Want yours reviewed?
Read the whole server, a document you can forward — fixed price, about a week. Email me the repository link and I'll send a fixed quote within two working days. The four open-source servers behind this are at github.com/les-k.