Last checked
How our MCP audit compares
What this page compares
Most published MCP audit offers we reviewed emphasize security: what an attacker, or an agent misled by a poisoned document, could access or make happen through your server. That work matters. Our audit answers a different question, alongside a focused security review: when an agent changes something through your MCP server, does the change land correctly?
We make real changes on a test tenant, overlap them, repeat them with stale data, and check the result against the platform’s own API. We also review permission boundaries, read-only switches, and data and credentials in model context, and report what your tool list costs in the model’s context. It is not a penetration test.
Evidence: In GitHub’s MCP server v2.1.0, 19 of 30 concurrent update pairs lost a change. GitHub’s own per-field API lost 0 of 28. Read the sample report
When two agents update the same record, both can get a success response while one change quietly disappears. The agent tells your user the work is done, your logs look normal, and the data is wrong.
The table sets our Write-Safety Audit next to two other kinds of help. “Not documented” means the public pages we reviewed did not describe it. It is not a claim that a provider never does it. Everything was checked on 12 November 2026.
The comparison
| Question | IsoKron Write-Safety Audit | MCP security audits and pentests | Free open-source scanners |
|---|---|---|---|
| Price | $2,500 fixed for one server, up to 40 tools ($500 per extra 25) | One server: $499 to $5,000 where published, some as starting prices. Multi-server packages run to $15,000 and up. Some providers quote per proposal | Free (Apache-2.0) |
| Turnaround | 5 business days from the day access is in place | One server: 3 to 6 days where published. Larger scopes take longer, up to 12 business days where published | You run it yourself, whenever you like |
| Main focus | Whether writes land correctly, plus a focused security review and tool-catalog cost | Security testing: permissions, attack paths, injection and connected-system exposure; exact scope varies | Security analysis of tool definitions, prompts, resources and server instructions; one also scans source code and packages |
| Security coverage | Focused review of permission boundaries, read-only switches, and data and credentials in model context. OAuth, backend injection, tenant isolation and supply chain are out of scope | Prompt injection, tool poisoning, permissions and credentials are addressed in published scope; depth and method vary. Most offers we reviewed also list some or all of: OAuth, backend injection, tenant isolation, supply chain | Prompt injection, tool poisoning and toxic flows; risky capabilities such as private-data access and destructive actions |
| Makes real writes on a test tenant | Yes | Testing approach varies. Some assessments explicitly avoid destructive actions; others exercise scoped operations under agreed conditions | Not documented. The scanners connect to servers to read definitions, or read code and packages |
| Overlapping (concurrent) writes | Yes: overlapping writes to the same record, counted in pairs | One published pentest checklist explicitly tests parallel resource-modifying calls for race conditions. That does not establish post-write data checks | Not documented |
| Checks the data afterwards: lost updates, stale writes, half-applied writes, silent no-ops, “success” for a change that never happened, retries that write twice | Yes | Not documented in the public scope we reviewed | Not documented |
| Same operation through the platform’s own API, as a control | Yes, where one exists | Not documented in the public scope we reviewed | Not documented |
| Annotation honesty: do read-only and destructive hints match what the tool does? | Yes | Not documented as a hint-versus-behavior check. At least one published scope reviews write and delete tools that lack a confirmation step | Rule-based checks on definitions, such as flagging destructive capabilities or a missing idempotency hint |
| Tool-catalog token cost | Reported in every audit, with annotation and schema flags and a pinned catalog snapshot | Not documented. One offer checks for tool output that can grow without limit | Not documented in these two scanners. Public web calculators estimate it |
| Fixes and retest | Fix pull requests (or patches) for every confirmed finding that can be fixed in the server’s existing code, and one free retest within 30 days | Fix guidance is common. Code fixes, where offered, are quoted separately. A retest is usually included | Re-run it whenever you like |
What you receive
- From us: a written report with reproduction steps, evidence, impact and a suggested fix for every finding; a 60-minute walkthrough; and an Evidence Pack. The test harness is frozen and independently timestamped before the first run, and you can verify the results yourself with one command that runs locally. See a sample report.
- Our public record: four published audits of vendors’ MCP servers (GitHub, Grafana, PostHog, Kubernetes). PostHog has merged one fix, co-authored by us, and approved three of our pull requests. Our other filings are open. Status as of 12 November 2026, listed here.
- From security audits and pentests: reports with proof-of-concept or reproduction steps are standard. Some providers publish a sample report, and some issue a full updated report or a retest letter after the retest. Some maintain open research, such as a public MCP pentest checklist, graded reference servers, or fixes merged into other projects.
- Compliance mapping or audit-support documentation: our report is not a pentest report and is not mapped to SOC 2 or ISO 27001 controls. Among security providers this varies: some map findings to SOC 2 or ISO 27001 controls, and whether a report is accepted is up to your auditor.
- What we need from you: a test tenant and a token scoped to it. We never use production data or credentials. Calls are throttled, and you revoke the token when the audit ends. Reports are private by default, and an NDA is available on request.
When another option is a better fit
- You need a penetration test or compliance evidence. Hire a security firm. If your server also writes data, our audit can run alongside their pentest. Security firms can also add our write-path testing to their own assessment. It complements security testing; it does not replace it.
- Your budget is under $1,000. Start with a free open-source scanner, a fixed-price MCP security audit (published one-server prices start at $499), or a freelance review on a marketplace (MCP security listings on Upwork start at $90). These are different services, so check what each one actually tests.
- Your server genuinely cannot change external state. A conventional security assessment or a scanner may be a better starting point.
- Your tool schemas are still changing every day. Our findings and fix pull requests are most useful once the write tools are stable enough for staging or a beta. Until then, running a scanner on each change may serve you better.
- You can’t give us a test tenant. We need one, with a scoped token. Some security audits need only a URL or a launch command.
- Your procurement requires a larger accredited firm, named certifications or ongoing monitoring. Choose a provider that meets those requirements.
How we compared
On 12 November 2026 we reviewed the public service pages and documentation of five MCP security audit and pentest providers (Appsecco, Codersarts, Cybersecify, MCP Audit and Oktsec) and two open-source scanners (Snyk Agent Scan and Cisco MCP Scanner). Each cell describes what those pages document. Providers often offer more scope on request, and prices and scopes change, so check with them before you decide. The pages we reviewed are listed under Sources below.
Product and company names belong to their owners. None of them is affiliated with IsoKron or endorses this page. If anything here about your service is wrong or out of date, tell us and we will correct it.
Request an audit
You leave with reproducible evidence of which writes fail and why, fix pull requests for what can be fixed in the server’s existing code, an Evidence Pack you can check yourself, and one free retest. The Write-Safety Audit is $2,500 fixed for one server with up to 40 tools, delivered in 5 business days from the day access is in place.
Sources
All pages were checked on 12 November 2026.
- Appsecco: Pricing; MCP pentesting; Sample report; MCP pentesting checklist on GitHub
- Codersarts: MCP Security Audit
- Cybersecify: AI and API penetration testing; Pricing
- MCP Audit: mcpaudit.io
- Oktsec: MCP penetration testing; Assessment and public findings
- Snyk Agent Scan: README on GitHub
- Cisco MCP Scanner: README on GitHub; Readiness rules
- Token-cost calculator example: PolicyLayer MCP Token Cost Calculator
- Upwork: Project Catalog search for “mcp security audit”
- IsoKron: Write-Safety Audit; Sample report; Upstream record