AI-agent & MCP security
Your agents have more access
than anyone scoped.
Agents read, write and act — through tools, connectors and MCP servers that accumulate permissions faster than anyone reviews them. We map what your agents can actually do, close the attack classes that matter, and prove it stays closed.
One real finding from your own agent stack, free — before any commitment.
Fixed scope · documented with evidence, not adjectives.
What we look for.
The attack surface of an agent isn’t the model — it’s everything the model is allowed to touch, and everyone allowed to talk to it.
Over-permissioned tools
The support agent that can read every table when its job needs three. Write scopes granted “temporarily” and never revoked. We build the real permission map — what each agent can actually do today — and cut it to least privilege.
Prompt injection paths
Everywhere untrusted content meets an agent that can act: emails, tickets, documents, web pages. Private data, untrusted input and a channel out is the lethal combination — we find where all three meet.
Tool & MCP poisoning
The servers and tool definitions your agents trust implicitly. Who publishes them, what changed since you adopted them, and what a compromised one could quietly do with your agent’s credentials.
Missing approval gates
Irreversible actions — payments, deletions, external sends — executing with no human in the loop. And when something does go wrong: logs that let you reconstruct what the agent did, or the absence of them.
Data paths out
Connectors that can move customer data somewhere you’d never approve, one crafted input away. Egress mapped, allowlisted, and watched.
How the work runs.
Three rungs. Each one earns the access the next one needs — standing access to your systems is the last thing we ask for, not the first.
The ladder
Start with the assessment. Everything after it is your call, informed by what it finds.
-
Security assessment fixed scope
Inventory of agents, tools, connectors and MCP servers. The real permission map set against the intended one. The injection and poisoning surface probed and documented with evidence — findings prioritized by what an attacker would actually do first.
-
Hardening sprint changing production behaviour
Least privilege applied, tool allowlists, sandboxing, approval gates on irreversible actions, logging that makes incidents reconstructable — and a regression suite so the next deploy can’t quietly undo any of it.
-
Continuous assurance standing access, earned
Re-tested on every change and every new tool adoption, with evidence kept audit-ready for the enterprise security reviews your customers will run on you.
What lands on your desk
- The permission map, as-built
- Findings with evidence and fix
- A regression suite your CI can run
- An evidence pack for security reviews