Maps what your AI agents can reach. Proves what an attacker can do with it.
Agent Surface maps what your AI agents and MCP servers can reach, then proves what an attacker could do with it. It runs on mcp-safeguard, the open-source MCP engine, and expands from there. The record below is proof: reported, fixed, and credited in public.
Findings credited in public by
The expert tier
Agent Surface finds the surface.
These three go deeper by hand.
mcp-safeguard, the engine behind Agent Surface, narrows what is worth looking at. These are fixed-scope, manual engagements for when a person needs to read the system and sign a report.
- 02
You ship an MCP server or AI agent with its own auth, and nobody outside the team has read that boundary.
A server that trusts client-supplied metadata, or forwards its own credentials past the boundary it meant to keep them inside, hands access to whoever asks. The record below shows what that looks like in practice.
The door
MCP / AI Agent Security Review
5 business days
How it works - 03
An auditor, an enterprise customer, or an insurer has asked for a pentest, and the date is theirs.
A scanner export gets sent back. The deal or the policy waits until a real report and a signed attestation exist.
The door
Procurement-Ready Pentest
5 business days
How it works - 01
One system makes you uneasy and you are not sure a full review is worth it yet.
Guessing wrong costs a review you did not need, or a bug that stays in production because nobody looked.
The door
Security Snapshot
1 to 2 business days
How it works
How we work
An open engine.
A person behind every report.
No client case studies are published. What can be shown is how the engine and the reviewer work together, and what that combination has produced in public.
- 01
You know who reads the code
The person you email reviews the system and writes the report.
- 02
An open engine, not a black box
mcp-safeguard, the open-source engine behind Agent Surface, is free to run yourself. No finding in the report is rated up to sell a subscription behind it.
- 03
Manual, with a proof of concept
Every finding was reproduced by hand, with steps you can repeat. Anything serious reaches you the same day.
- 04
Fixed scope, in writing
Scope and deliverables are locked in a signed Statement of Work before day 0.
The public record · every row links to the vendor
Google
CVE-2026-14540
Fixed Jun 2026Server-side request forgery in the generic HTTP source and tool components of MCP Toolbox.
Reported. Fixed by Google, credited by name.
GitHub
github-mcp-server #3056
Merged Aug 2026A redirect-following transport re-attached the GitHub token on every hop. Hardened so it's only attached to GitHub's own configured hosts.
Patch authored here, merged upstream.
Weaviate
PR #12961 · HackerOne
Merged Sep 2026Google module accepted an arbitrary apiEndpoint, a credential-exposure path.
Confirmed. Fixed by Weaviate.
JPMorgan Chase
jpmorgan-payments/ai #19
Merged Sep 2026One tool skipped the domain allowlist its sibling tool already enforced.
Validated and fixed through JPMC Responsible Disclosure.
1Password-MCP (community)
GHSA-q3gg-rgxh-gh64
Sourceop_run leaked the OP_SERVICE_ACCOUNT_TOKEN master credential to subprocesses and model context.
Advisory published, credited by name.
Side by side
Same labels,
three answers.
| Attribute | 01 Snapshot | 02 MCP Review | 03 Pentest |
|---|---|---|---|
| Best when | You want a second opinion on one system before spending on a full review. | You ship an MCP server or an agent with its own auth, and nobody outside the team has read it. | An auditor, an enterprise customer, or an insurer has asked for a pentest and the date is not yours. |
| Target | One application, API, or MCP server | One MCP server or AI agent and its auth boundary | Web application, API, or infrastructure perimeter |
| Turnaround | 1 to 2 business days | 5 business days | 5 business days |
| Deliverable | One to two page written summary | Severity-rated report, proof of concept per finding, walkthrough call | Severity-rated report, signed attestation letter, fix PRs where small |
| Retest | None. Fee credits toward a full engagement | One, free, within 60 days | One, free, within 60 days |
| Access | A URL or a repo, and confirmation you control it | Read access to the repository. No production access | Staging or test environment preferred |
| Full page | How it works | How it works | How it works |
Before you email
The questions
that stop people.
One email to start
Not sure which one? Describe the system. You get a straight answer.
Replies come from the person doing the work, within one business day.