CAIN-42 CAIN StudioProduct 2 · the core revenue
MCP / Agent Security Review — $2,500
Review the tool surface an agent can reach, rank the findings, and hand over the smallest patch with a signed bundle.
What it is
A 48-hour review of the tool surface an AI agent can reach: the tool definitions, the dangerous parameters, the leaked credentials, the injection surface. You rank the findings and hand over the smallest patch, with a signed bundle and a verifier.
Who it is for
- Teams shipping MCP servers or agents that call tools.
- Security leads who need findings, not a dashboard.
- Companies whose customer or auditor asked “how do you know the tool call was authorized?”
The trigger
A launch, an incident, an audit, or a customer asking for evidence. The review is the step after the questionnaire.
What they get (48 hours)
- A ranked finding list with severity and the exact location.
- The smallest patch per finding.
- A signed record, a pinned key, and a standalone verifier.
- A 30-minute walkthrough where they run the verifier.
Build a quote
Total: $1,500
How to sell it
Write the first email
The call script
“Which tools can your agent reach today?” “If one of those tools were tricked into doing something else, would you know?” “I review that surface, rank the findings, and hand you the smallest patch — signed, with a verifier you run yourself. $2,500, 48 hours. If the bundle doesn’t verify, you don’t pay.”
Qualification questions
- How many MCP servers/tools are in production?
- Has a customer or auditor asked about them?
- Who owns the fix?
- Can we see the tool definitions this week?
Objections
“We already run a scanner.”
A scanner gives you alerts. This gives you a ranked finding, the patch, and a proof the patch works. Keep the scanner; add the proof.
“Isn’t this just a pen test?”
A pen test ends with a report you trust. This ends with a report plus a verifier you run yourself.
“Why not wait until after launch?”
After launch, the finding is an incident. The review is cheaper before the tool is in the path.
Delivery checklist
Upsell
The review finds the issues. Fix + Prove ships the patch and proves it.