Vibe code audit
An MCP server lets an AI model call tools that read and change your data. We test what those tools can be talked into: replayed confirmations, changes to money without a human approval, untrusted text reaching the model, and limits that break under parallel requests.
MCP, the Model Context Protocol, is a standard way to give an AI model tools: read a record, cancel a subscription, send a payment. The risk is that the model decides when to call them. Untrusted text can steer it, a confirmation can be reused, and a write can happen with no human approval at all.
The same risks apply to any AI assistant with tools, whether it speaks MCP or a custom tool interface. We test the layer between the model and your data, where the checks have to live.
We test every tool the model can call against six questions. Does the tool check who the user is? Is each confirmation used once? Does a human approve changes to money? Does untrusted text reach the model as instructions? Do usage limits hold under parallel requests? Are consent and plan checked on every path?
| Check | What we test | What goes wrong when it is missed |
|---|---|---|
| Tool permissions | Each tool checks the signed-in user, their role and their plan before it runs. | A free-plan user reaches a paid AI feature through a side endpoint. |
| One-time confirmations | Each confirmation is consumed once and returns the original result on retry. | One approval produces several cancellations or transactions. |
| Human approval | Changes to money and cancellations need an approval event outside the model. | The model changes a price because a message told it to. |
| Prompt injection | Text from users, files, names and history kept apart from trusted instructions. | A category name a user typed ends up inside the system prompt. |
| Usage and spend limits | Limits reserved atomically, so parallel requests cannot pass them. | AI provider costs run past the plan limit. |
| Consent | AI consent enforced before every model call, on every path. | A user who opted out still has their data sent to the model. |
Prompt injection means hiding instructions inside text the model reads, such as a file name or an email, so the model follows them instead of yours.
In one audit we ran 52 boundary checks against an AI assistant that could pause, cancel and reassign subscriptions through a tool interface. 35 controls passed and 15 security expectations failed. One confirmation produced three cancellations under concurrency, and a share changed from €4.99 to €499 with no human approval event.
One confirmation produced three cancellations under concurrency.
Assistant confirmations were reusable. The fix consumes it atomically and returns the original result on retry. In a personal finance app we audited, one AI-generated transaction preview replayed four times created four transactions. From our anonymised sample report and a published case.
Sample report based on a real audit. Client details and figures changed.
Get the sample reportA share changed from €4.99 to €499 with no human approval event.
Changes to shares and cancellations were approved only by the model following its instructions. The fix is a user-bound approval outside model control, or a read-only assistant at launch.
At 4 of 5 daily queries used, 6 parallel requests succeeded.
Usage was checked before a request and charged after it. Besides the security gap, that means uncontrolled AI provider costs. Injected text also reached the model on all seven input surfaces we tested.
We run the checks against your own request-building and tool code in an isolated copy, with synthetic users and mocked providers. Nothing touches production. You get every failed check with its fix, ranked by priority, inside the vibe code audit report, plus a debrief call with the engineer who ran it.
We list every tool the model can call, what it reads and what it can change.
Permissions, replay, approval, limits and consent tested on each tool with synthetic users.
A prompt-injection corpus run against your real handlers: chat, names users typed, uploaded files, history and tool results.
Ranked findings, the fix for each, and a fixed-price cleanup quote.
AI assistant and tool checks are part of the vibe code audit, which starts from $199 at a fixed price. After the audit you get a fixed-price quote for the fixes, agreed before any work starts. You decide whether to take it. Buying the audit commits you to nothing else.
They can be. An MCP server gives the model tools that act on real data, and the model decides when to call them. The risk depends on the checks inside each tool: who the user is, whether a human approved the change, and whether a confirmation can be used twice.
A scanner checks known patterns in code and configuration. It does not know which of your tools move money or which changes need a human approval. We test the behaviour of your tools with synthetic users, including replay and parallel requests, and explain each finding to you in a debrief call.
MCP security is the set of controls around the tools an AI model can call through the Model Context Protocol. It covers who may call each tool, what each tool may change, which actions need a human approval, how untrusted text is kept apart from instructions, and how usage limits are enforced.
Book a 30-minute call. Tell us which tools the model can call, and we will tell you what the audit tests.
Prefer to talk?
