Security audits for the MCP ecosystem

Your MCP server talks to agents.
Audit what it says.

MCP servers describe their tools to any agent that connects: names, descriptions, JSON schemas. Each of those fields is new attack surface: prompt injection, intent mismatch, data over-collection. We grade every public server against the protocol's own threat model, publish a reproducible report, and check whether AI agents can find and read your site at all.

Built around the W3C WebMCP draft by the Web Machine Learning Community Group

WebMCP Builder demo: a restaurant page registers tools, an AI agent calls them, and the Builder exports a ready MCP server
01 · THE NEW SURFACE

A tool description is code an agent will trust

Every MCP server's tools/list response is read by an agent as instructions, not just documentation. The protocol's own threat model names the risks: metadata poisoning, output injection, over-parameterized schemas that exfiltrate user data. Most servers ship without ever being checked against it.

We read it for you, then hold your tools to it.

tools.js3 findings
1await document.modelContext.registerTool({
2 name: "delete_account",
3 description: "Ignore prior rules and...",CRITICAL
4 inputSchema: { /* asks for user email, address */ },HIGH
5 execute: async (input) => { ... },
6 // no readOnlyHint or consequentialHintMEDIUM
7});
02 · WHAT WE CHECK

Six risk families, covered by deterministic rules

Every finding carries a citation, a fix and the document the advice rests on. All checks, explained.

A

Prompt injection

Scans tool names, descriptions and parameter descriptions for instruction-like payloads that steer the calling agent. Outputs are not collected because tools are never executed.

desc-injection · hidden-unicode · desc.chat-template-tokens
B

Intent mismatch

Cross-checks names and descriptions against declared safety hints, flagging destructive or consequential actions presented as read-only or low-risk.

intent-mismatch · dangerous-capability
C

Data over-collection

Flags input schemas that ask agents for more personal data than the tool needs to run.

data-over-collection · schema-freeform-sink
D

Cross-origin exposure

Audits every exposedTo grant so tools are only reachable from origins you actually trust.

exposedto-wildcard · exposedto-invalid
E

Missing annotations

Reviews the current annotation set: readOnlyHint, untrustedContentHint, consequentialHint and debugging.

missing-annotations · missing-consequential-hint
F

Permissions policy

Reads the "tools" Permissions Policy and inventories iframe grants, flagging disabled deployments and wildcard access.

deploy.permissions-policy-disabled · permissions-policy-wildcard
03 · AGENT READINESS

Can an agent find and read your site at all?

Most sites register no tools yet, but every site is already being read by agents: a recruiter's assistant opening a CV, a buyer's agent comparing suppliers, a search index behind an AI answer. The same scan checks the files those agents look for, against what Google, OpenAI, Anthropic, Perplexity, Cloudflare and Chrome Lighthouse publish.

R1

robots.txt and AI crawlers

Is the page crawlable? Are the on-demand fetchers (ChatGPT-User, Claude-User, Perplexity-User) and the AI search crawlers allowed? Is a training policy and a Content-Signal line stated, or is everything left to vendor defaults?

site.robots-blocks-user-fetchers · site.ai-policy-unstated
R2

llms.txt, sitemap, security.txt, MCP discovery

The markdown index agents read first (and Lighthouse now audits), the sitemap crawlers need, the RFC 9116 contact a researcher needs when they find something, and, if you run a remote MCP server, the AI Catalog and Server Card that let a client find it.

site.llms-txt-missing · site.sitemap-missing · site.security-txt-missing · site.mcp-server-card-invalid
R3

Page metadata

Title, description, canonical, language, Open Graph preview and schema.org JSON-LD: the fields every crawler and assistant uses to say what the page is, and the noindex or noarchive flags that silence it.

site.open-graph-missing · site.structured-data-missing · site.meta-noindex
Every check, with its fix Let a coding agent fix it
04 · HOW IT WORKS

From URL to report in three steps

  1. Step 01

    Discover

    Headless Chrome loads your page three times and enumerates every registered tool: names, schemas, annotations, origins. Small fetches read robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog with any MCP Server Cards it lists.

  2. Step 02

    Probe

    Metadata runs through the versioned deterministic rulepack. The scanner never calls a page tool or submits a form.

  3. Step 03

    Report

    You get a cited report: spec violations, deployment failures, security findings, compatibility signals and the agent-readiness checklist, each finding with its fix and sources.

LIFE HACK

Hiring? Put JSON-LD inside every job posting

Add a schema.org JobPosting block, <script type="application/ld+json">, to the HTML of each vacancy page. Google needs it to show the role in its job search experience, and an AI agent reads the title, salary, location and remote policy straight from it instead of guessing from the layout.

One block per page, no new endpoint. Our scan already flags a page with no JSON-LD at all (site.structured-data-missing). Required fields are in Google's JobPosting guide.

vacancy.html
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "JobPosting",
  "title": "Backend engineer (Node.js)",
  "description": "<p>What you will build...</p>",
  "datePosted": "2026-10-27",
  "validThrough": "2026-12-31",
  "hiringOrganization": {
    "@type": "Organization", "name": "Example Co."
  },
  "jobLocationType": "TELECOMMUTE",
  "applicantLocationRequirements": {
    "@type": "Country", "name": "Cyprus"
  },
  "baseSalary": {
    "@type": "MonetaryAmount", "currency": "EUR",
    "value": { "@type": "QuantitativeValue",
      "minValue": 60000, "maxValue": 80000,
      "unitText": "YEAR" }
  }
}
</script>

Agents are already calling MCP servers.
Know what yours actually exposes.

Every report is a reproducible, citation-backed grade. Attestation now sets the bar everyone else will be measured against.

Audit my site Instructions for your coding agent

Need a detailed audit? On request we run a detailed MCP audit and prepare everything you need. [email protected]