CAIN-42 CAIN Studio
Sign inGet started
Menu
CAIN-42

One page · fixed price · 3 business days

MCP Security Assessment — $500

One MCP server or AI agent, up to 20 tools. A static review of the declared tool surface, a human-reviewed findings report, a default-deny policy, and a signed evidence bundle your buyer verifies offline.

Pay $500 securely See the sample Read the scope

The problem

You are giving an agent tools that touch files, shells, databases, browsers, cloud APIs or customer data. A buyer or security reviewer asks: what stops a tool call you did not authorize? A paragraph in a document is not an answer. A signed, checkable artifact is.

What you receive

FileWhat it is
report.mdExecutive summary, scope, method, findings with evidence and reproduction, remediation, limitations
findings.jsonMachine-readable findings with stable locations and severity
policy.jsonA default-deny MCPGate policy generated from the findings (a recommendation, not a certification)
evidence.zipSigned, hash-chained record with a standalone verifier that imports no CAIN code
Walkthrough30 minutes on the findings, the policy and offline verification

Scope

Included

  • One MCP server or one agent.
  • Up to 20 tool definitions.
  • Prompt-injection and tool-poisoning phrases.
  • Destructive-action exposure.
  • Unbounded path, URL/SSRF, shell, SQL and code parameters.
  • Credential material in descriptions or examples.
  • Human review of every finding.
  • Default-deny policy and prioritized remediation.

Not included

  • Live exploitation or penetration testing.
  • A guarantee that every issue is found.
  • Production remediation (separately contracted).
  • Compliance certification, legal advice or an audit opinion.
  • More than 20 tools or more than one server/agent.

Why you can trust it — and what that does not mean

The bundle is signed with Ed25519 and hash-chained. The verifier recomputes the record on your machine with no CAIN import. If the report changes, the verifier fails.

The signature proves

The record is the one we signed, the chain is intact, and the report, findings and policy match the signed hashes.

The signature does not prove

That your system is secure, that every vulnerability was found, that a third party reviewed it, or that the policy is correct for your environment.

The review is heuristic and static. A clean section means no rule matched, not that the tool is safe.

What you provide

  1. A tools/list JSON response, or a bare list of tool definitions.
  2. The policy you think you have, if one exists.
  3. One technical contact authorized to confirm what is deployed.
  4. A signed authorization form.

Do not send live credentials, API keys, private keys, customer records or production data. Redact secret values yourself and keep the schema shape; we run a redactor again on receipt; if it finds a live secret we stop, delete it and ask you to rotate it. Email is not encrypted by CAIN; agree on a channel first if your policy requires it.

What happens after payment

  1. You receive the receipt and the intake form.
  2. You send the redacted definitions and the signed authorization.
  3. We confirm the scope and delivery date within one business day.
  4. The 3-business-day clock starts when the inputs are accepted.
  5. You receive the report, findings, policy and signed bundle; we offer a 30-minute walkthrough.
  6. You run the verifier yourself. If it fails, we fix it or refund the affected deliverable.

Price and refund

$500 USD, fixed fee, one-time. Stripe handles the payment; we never see or store your card number.

Full refund before work starts. After work starts and before delivery, 50%. After delivery, we fix or refund the affected deliverable if a material defect is confirmed. The remedy is limited to the fee paid.

Pay $500 securely Ask a question

FIRME AI CORPORATION · vincent@firmeai.com · https://cainstudio.online/assessment/