MCP server audit, fixed price
IsoKron tests your MCP server the way an agent uses it, including the write paths. Every finding is checked against the vendor’s own API as a control, challenged by a separate AI refuter in a clean context, then reproduced and reviewed by a person before you see it.
Fixed-price reviews from $495; full audits from $1,450. See the packages
$495
One server, up to 40 tools. A read-only review of the tool catalog and schemas: a first look, not an audit.
Turnaround: 3 business days
Secure checkout by Stripe. We email you within one business day to confirm the server and access. Terms of sale and refunds
$1,450
$950 founding rate
One server, up to 25 tools. Read and write paths, on a test tenant.
Turnaround: 7 business days
Scoped by email (call optional), then invoiced at the listed price.
$2,900
$1,950 founding rate
Up to 2 servers or 50 tools.
Turnaround: 10 business days
Scoped by email (call optional), then invoiced at the listed price.
Fixes are priced separately. If you want us to fix what we find, we quote that after you have read the report, so the audit has no incentive to inflate findings.
More servers, multi-tenant or OAuth setups, or client and server together. Send your tools/list and we’ll quote a fixed price.
typically from $4,500
Founding rate for our first five clients who agree to a redacted case study: Audit $950 (normally $1,450), Audit + Agent Benchmark $1,950 (normally $2,900). You approve the exact case-study text before anything is published.
We don’t guarantee a number of findings. That would give the audit a reason to pad.
github/github-mcp-server v2.1.0
In a controlled test of concurrent updates to two different issue fields, 19 of 30 pairs lost one change across three runs; GitHub’s per-field API lost 0 of 28. Our fix is open as pull request #3781; it has not been reviewed or merged upstream.
github/github-mcp-server v2.1.0
GITHUB_READ_ONLY=yes (or on) is parsed as false, so the server starts with write tools enabled and no warning.
github/github-mcp-server v2.1.0
Filed as low-severity hardening: the URLs expire, but they land in model context.
PostHog MCP server (PostHog Cloud, test accounts)
"false" into true, and null into 0.A client that sent the string "false" could store true, and nothing reported an error.
PostHog MCP server (PostHog Cloud, test accounts)
6 of 11 tested pairs lost one update. PostHog merged the fix (insights only) in #131620, which carries our commit.
github/github-mcp-server v2.1.0
In our audit, Claude Opus via Claude Code completed four routine development jobs through the server using MCP tools only (bug fix to merged PR, PR review, issue triage, multi-file rename): 17–33 tool calls and about $0.77–$1.37 per job, as Claude Code’s reported API-equivalent cost, two runs per job. Submitting a pull-request review with inline comments took 5 MCP calls; GitHub’s REST API accepts the same review, comments included, in one request.
An open issue is a report, not a confirmed vulnerability, until the maintainers say so.
Switches that must fail closed, credentials in model context, token scopes, prompt injection via tool outputs, and catalog changes between runs. Example: read-only mode that stays off. Background: auth, rate limits and observability for a production MCP server.
Lost updates when two agents write at once, coerced types, writes that half-apply, “success” that changed nothing, and retries that write twice. Examples: concurrent issue updates that revert, schemas that turn false into true.
Calls, tokens and dollars per real task, catalog overhead in context, and tool designs that force extra round trips.
Step 1
A script reproduces the finding; the same operation runs through the vendor’s own API. For the lost-update finding, GitHub’s per-field API lost 0 of 28.
Step 2
A separate AI refuter, in a clean context and often on another model, tries to explain the finding away. If it can, the finding is dropped.
Step 3
A person reruns the reproduction and reads the evidence before anything reaches the report.
In the GitHub audit, search_code returned nothing on a private repository. The refuter ran the same search through GitHub’s REST API: also nothing. A GitHub indexing effect, not an MCP bug, so it was never reported.
Agent benchmark harnesses are hashed and frozen before the first measured run. Calls are throttled, only test tenants are used, and every number has a denominator and a control.
What we never need
Confidentiality
Reports are private by default; NDA on request. We publish nothing without your written consent. An audit tells you what we tested and found. It is not a promise that the server is secure.
We don’t present an audit of code we built for you as independent work.
IsoKron audits MCP servers and maintains open-source MCP tooling. Judge us on evidence you can check: the upstream issues and pull requests above, the method on this page, and the tools we maintain.
Our founder spent ten years as a support engineer at Ring, through its years at Amazon. Support engineering is reproducing what customers report until you can show the cause; our audits apply that to MCP servers.
The MCP Server Snapshot is $495. The MCP Server Audit is $1,450, and Audit + Agent Benchmark is $2,900. Founding rate for our first five clients who agree to a redacted case study: $950 and $1,950. Larger or multi-server work is typically from $4,500, as a fixed quote.
3 business days for the Snapshot, 7 business days for the Audit and 10 business days for Audit + Agent Benchmark, counted from the day access is in place.
Yes with --read-only or GITHUB_READ_ONLY=1/true; yes/on silently leave it off. In v2.1.0, GITHUB_READ_ONLY=yes (or on) is parsed as false, so the server starts with write tools enabled and no warning (github-mcp-server issue #3747). To check your own setup, start the server with your setting and call tools/list. If any write tools are listed, read-only mode is off.
A test tenant and a token scoped to it. Testing uses test tenants and test accounts only, never your production data or credentials. Calls are throttled, and you revoke the token when the audit ends.
Reports are private by default, and we sign a reasonable NDA on request. Nothing is published without your written consent. Bugs in third-party dependencies go to their maintainers only after we coordinate with you.
Scanners read tool descriptions and known patterns; a pentest looks for a way in. This audit drives the server the way an agent does, including the write paths, and checks that the data ends up correct and what each task costs.
Each finding is checked against a control first, usually the same operation through the vendor’s own API. Then a separate AI refuter in a clean context tries to explain it away, and a person reproduces and reviews it. What does not survive is dropped.
Yes. The GitHub MCP server findings on this page came from an outside audit of a server we do not own.
A clean report is a result. You still get the permission map, the cost baseline and the pinned catalog, and we never pad a report.
Send the repository or URL, roughly how many tools it has, and anything you’re worried about. We reply with a fixed quote and a delivery date. No sales call needed.