We review one MCP server and one host integration using source and configuration analysis, selected controlled tests, minimized telemetry, and analyst-led validation. Automated indicators are narrow and are never exploit confirmation by themselves.
Rasheed Farhat is accountable by name for every review. Findings come with reproducible evidence and a written statement of what was not covered.
An analyst reviews source, configuration, identity, authorization and trust boundaries. Tooling assists; it does not decide.
Five selected telemetry indicator classes, backed by inspectable rules — not a claim of comprehensive detection.
Every finding is traceable to source, configuration, or an approved test you can re-run.
What was tested, what was skipped, and what this review does not cover — stated in writing.
This review is built for teams shipping an MCP integration into a product path — where a tool can read files, hold a credential, or act on data on a user's behalf.
Not sure it fits? and we'll tell you plainly whether it's in scope.
Local stdio MCP traffic is not visible to network monitoring alone, and an automated match is only a starting point. Whether a matched pattern is actually a vulnerability depends on the code path, the identity making the call, the permissions behind it, and the surrounding architecture — context a scanner does not have.
The service combines that context: implementation and configuration review, identity and authorization analysis, host permissions, and observed tool traffic, correlated by a person who can say why a finding is — or isn't — exploitable in your environment.
The manual review is the product. The five telemetry checks are one input to it — never the conclusion.
Read the full methodWhere the host process, the MCP server, tools, credentials and data meet — and which of those crossings are actually authorized.
Tool definitions, argument handling, permission scopes, and identity — read directly, not inferred from traffic.
Selected tests in an approved non-production environment, plus a bounded, minimized telemetry capture analyzed offline.
Each indicator and test result is verified for reachability, preconditions and impact before it becomes a finding.
A file-read tool accepted a relative path that resolved above its configured root. Confirmed reachable from the host agent in an approved test; a crafted argument returned a file outside the workspace.
Remediation: resolve and canonicalize the path, then reject any result outside the configured root; enforce the workspace boundary at the host as defense in depth.
Details, identifiers and paths are fabricated for illustration.
The public sample reproduces hit counts against self-authored fixtures and one self-authored benign corpus. These verify that the tooling behaves as reported; they do not establish independent accuracy or predict how it performs on your traffic.
The automated checks are partial by design. Each row states what it flags, where it can be evaded, and the compensating control that closes the gap. Automated indicators require analyst verification.
| Indicator | Target vector | Status | Known gaps | Compensating control |
|---|---|---|---|---|
| SAF-T1001 | Tool poisoning via hidden text | Partial | Plain-text directives; homoglyph keywords. | Unicode normalization; manual schema review. |
| SAF-T1104 | Sensitive absolute-path read | Partial | Paths outside the known-sensitive list. | Host-level jail / container access limits. |
| SAF-T1105 | Relative path traversal | Partial | URL-encoded traversal sequences. | Enforce workspace jail at the host. |
| SAF-T1201 | Rug-pull baseline drift | Partial | Updates that keep the same size and hash. | Hash pinning; periodic manual code audit. |
| SAF-T1502 | Credential-exposure indicators | Partial | Base64 payloads; custom argument names. | Egress filtering; TLS inspection. |
Behavior-only compromise that leaves telemetry unchanged is not covered by these checks — the manual review is where that risk is addressed.
A sample of the lines the checks emit, drawn from self-authored fixtures. This is a static illustration — not a live feed, and not customer data. Each adversarial line is an indicator that an analyst then has to confirm.
We do not ask for credentials, production access, or raw database contents. You capture and minimize telemetry on your own network, review the residual-disclosure report, and decide whether the file is safe to share. The minimizer removes known content-bearing fields — it is not a general secret or PII guarantee.
Log JSON-RPC tool transactions through a transparent, inspectable pipeline proxy on your own network.
Run the documented redaction locally. It removes or replaces content-bearing fields while keeping the paths, identifiers, commands and descriptions the review needs.
Inspect the minimized file and its residual-disclosure report by hand. Nothing leaves your network unless you choose to send it.
The review is performed by one independent specialist, not a rotating team or an automated pipeline. The method is kept inspectable so you can verify the work rather than take it on trust.
About the practiceThe current design-partner pilot is a fixed experimental $1,250 for one authorized MCP server and one host integration. Customer demand and the price have not been independently validated. Scope, authorization, data handling, exclusions, and price are agreed in writing first.
See scope & the offerTell us what it does and where it's headed. We'll reply with whether it's in scope and what a review would look like.