Local-only scorer · no upload

Know what can go wrong before your MCP tools go live.

Score practical controls for permissions, prompt injection, tool poisoning, secrets, isolation, authentication, egress, and auditability. Then turn the gaps into a repeatable launch gate.

Score my deployment

45audit controls in the paid kit

24safe regression scenarios

$12one-time digital download

Free MCP launch risk score

Fast triage, not certification. Answers stay in your browser.

Sensitive or production data access?Customer, internal, regulated, financial, or production data.

Write, delete, send, purchase, or publish tools?Externally visible or irreversible actions.

Arbitrary shell or command execution?Generic exec dramatically increases blast radius.

Human approval for high-impact actions?Financial, destructive, privileged, or external-send actions.

Approved-server inventory?Owner, source, version, permissions, review date.

Strict server-side tool schemas?Typed fields, ranges, allowlists, unknown-field rejection.

Scoped, short-lived credentials?Avoid broad shared tokens and credential passthrough.

Restricted outbound destinations?Unknown egress makes exfiltration harder to contain.

MCP server isolation or sandboxing?Constrain filesystem, process, network, and tenant access.

Attributable tool-call + approval logs?Enough evidence to reconstruct who, what, when, and outcome.

Indirect prompt-injection regression tests?Documents, web/email content, RAG, and tool outputs.

Estimated launch risk

High

Fix first

One-time digital download

$12

For engineers shipping MCP-enabled agents. No consulting, subscription, or custom audit.

Buy securely with Stripe

Immediate browser download after successful payment.

What’s in the kit

45-control audit workbook
Priority, verification, evidence, remediation, owner, status.

24 safe regression tests
Injection, tool, auth, approval, egress, logging, resilience.

Permission + evidence matrices
Map tools, scopes, approvals, owners, and proof.

Launch gate + incident runbook
Ship/block decisions, containment, recovery, retesting.

Free companion: prompt-injection test generator

Build a safe regression checklist for RAG, MCP tool outputs, approval gates, secrets, scopes, and cross-server trust.

Generate a test plan

Methodology

Independent product informed by public security guidance. Use only on systems you own or are authorized to assess. This tool and kit do not guarantee security or compliance.