MCP & agent-surface security
We secure the layer where AI agents touch the real world.
An agent is only as safe as the tools you handed it. Mainno audits that tool surface — the MCP servers, integrations and permissions that let a model read files, move money and delete records — and writes the finding a board can act on.
The layer nobody is watching.
The Model Context Protocol gives agents the ability to act. It shipped with no authentication by default, no audit trail, and no permission model at the tool level — so every server you connect widens what a single mistake can reach.
Nobody registers MCP servers in a CMDB. They are not covered by the vulnerability scanner, and they do not write to the SIEM. After an incident there is often no record of what the agent did, or by whose authority.
The failure classes are ordinary security failures wearing new clothes: command injection and sandbox escape in a tool, untrusted instructions smuggled into a tool description, credentials aggregated into one over-broad server, and irreversible actions an agent can take with no confirmation step at all.
Ordinary, that is, until you notice who is holding the tool. The same flaw that was a bug in a script becomes an autonomous decision when an agent can call it unprompted.
What we do
Fixed scope, fixed price, fixed turnaround. You know what you are buying before you speak to anyone.
-
Exposure snapshot
no charge
A read-only review of your public MCP tool manifest — surface, scope language, destructive verbs, instruction-injection markers. One concrete observation, delivered within a day. Nothing is tested and nothing on your systems is touched.
-
MCP & agent-surface audit
$1,200 · 3–5 days
Full tool-surface enumeration, description-poisoning analysis, guard-control testing, parameter-injection and path-confinement checks, and a privilege review of every credential the server holds. Findings mapped to OWASP LLM Top 10, MITRE ATLAS and your regulatory obligations.
-
Agentic deep assessment
$3,500 · 7–10 days
For multi-server estates and anything touching money, personal data or irreversible operations. Active exploitation with proof-of-concept chains, cross-agent lateral movement analysis, and retest after remediation.
-
Continuous agent security
$900 / month
Monthly re-audit of the tool surface, drift and rug-pull alerting when a description or schema silently changes, onboarding review for new servers, and four-hour remote incident support.
How an engagement runs
Authorisation first, always. Nothing is actively tested without a signed scope.
Snapshot
We review what your servers publish publicly and send you one named observation. You decide whether it is worth a conversation.
Scope and authorisation
Written scope: systems, windows, exclusions, contact. Out-of-scope systems are never touched.
Testing
Enumerate, reason, then prove. Every finding is reproduced with a working proof of concept before it is written down.
Report and retest
Severity, evidence, business impact and remediation — then a retest to confirm the fix actually closed it.
“The tool description is not documentation. It is an instruction the model will obey.”
From a redacted finding — a private key path hidden inside a tool's own description.
Our product.
Not every problem needs a person attached to it. Where the work is mechanical and repeatable, we build the tool, publish it, and keep the human judgement for the part that needs it.
-
CryptoAgility
open source · AGPL-3.0-or-later
Every cryptographic asset in your estate is somewhere, and almost nobody can point at where. CryptoAgility scans source, configuration, certificates and live TLS connections, classifies each asset by quantum exposure, and produces an audit-ready CycloneDX CBOM plus a prioritised PQC migration register. It runs offline inside your own network — no telemetry, no outbound calls — and it is already on PyPI.
Product page, pricing and the honest limitations →
Published work
We publish our tooling and our measurements, so that anyone can check what we claim rather than take it on trust.
-
mcp-surface-scan
open source · MIT
A read-only scanner that connects to an MCP server, reads the tool manifest it advertises publicly, and classifies each tool by consequence — destructive, execute, financial, credential. It never invokes a tool and never touches anything not advertised.
github.com/chimaobikanu/mcp-surface-scan -
The published agent surface
research note
What 710 advertised tools across 68 publicly reachable MCP servers actually expose: 7.3% destructive, 3.0% handling credentials, and 32% of servers advertising at least one high-consequence tool by name alone. Aggregate patterns and method only — no named server is identified.
Read the note
Start with the free snapshot.
Send us the endpoint of one MCP server you run, and we will return a one-page read of its public surface. If there is nothing to find, we will say so — that is a useful answer too.
- Company
- Maobyte Innovations Ltd
trading as Mainno - Director
- Chimaobi Kanu
- c.kanu@mainnoltd.com
- Phone
- +234 803 551 8314
- Research
- hackerone.com/ciphercasper
github.com/chimaobikanu/mcp-surface-scan