Who should start with an MCP Risk Review?

Start here when your team is already connecting MCP servers or AI tool clients into real workflows and wants a fast security-minded decision before rollout.

What do I get in the 48-hour review?

You get a narrow review of MCP configs, tool permissions, obvious exposure paths, and a prioritized memo that ends in a clear go, fix, or escalate recommendation.

When does this escalate into a Build Readiness Audit?

Escalate when the risk is broader than MCP configuration or tool permissions, or when the surrounding product architecture and implementation sequence also need deeper review.

Does the MCP Risk Review include penetration testing or compliance certification?

No. Network penetration testing or a red-team engagement. SOC 2, ISO 27001, HIPAA, or any other compliance certification or attestation. A full application security code audit beyond the MCP surface, that belongs in a Build Readiness Audit instead.

MCP Risk Review

48-hour MCP security decision before an avoidable rollout mistake.

Founder-led narrow review for teams already connecting MCP into sensitive AI workflows and wanting a clear go, fix, or escalate decision fast.

Fixed investment: $3,000. Typical duration: 48 hours.

Free scanners can already list findings, ours included. What they cannot do is decide. This review is the human call on scanner output: 16 scanners read and prioritized by a person, not an automated report forwarded unread. If the review finds something to fix, remediation is a separate scoped engagement, never bundled into this fixed scope.

Started from: MCP Risk Review booking page. That context will stay attached if you preview the brief or request the review from here.

Request MCP Risk Review Preview one-page buyer brief

Prefer an async path? Request async risk review or explore the fit-call option. Reserve the narrow lane if the MCP problem is already clear. If the risk is broader than one MCP decision, escalate into a Build Readiness Audit instead of forcing this fixed-scope review. Open the mcp-scan proof surface first if you want to inspect the public proof path before you start.

How ThynkQ delivers

Scope lock, review, and a written decision in 48 hours.

What you get in the 48-hour review

48-hour manual review of MCP configs, tool permissions, and obvious exposure paths
Prioritized remediation memo across secrets, prompt injection, supply chain, and network egress risk
Clear decision: safe to proceed, fix before rollout, or escalate into a deeper Build Readiness Audit

Best fit when

You are already connecting MCP servers or AI tool clients into a real workflow
One bad configuration could leak secrets, over-expand permissions, or create rollout risk
You need a fast human decision before a broader implementation or security project starts

Not fit when

You are not using MCP yet
You need a full application security program instead of a narrow MCP decision
The work already includes broad architecture risk that belongs in a Build Readiness Audit

If the risk is broader than MCP configuration and permissions, move into Build Readiness Audit.

What this review covers

Manual review of MCP client and server configurations, tool permissions, and credential flow
mcp-scan CLI findings across its 16 scanner modules, read and prioritized by a person before anything reaches the memo
Prompt injection, secrets exposure, supply-chain, and network egress risk on the MCP surface in scope

What this review does not cover

Network penetration testing or a red-team engagement
SOC 2, ISO 27001, HIPAA, or any other compliance certification or attestation
A full application security code audit beyond the MCP surface, that belongs in a Build Readiness Audit instead

mcp-scan flags patterns, not confirmed exploits. Some findings will be false positives, and its precision and recall have not been independently published yet, including our own false-positive rate. See the research ledger.

How the 48 hours run

Hour 0: scope lock

Confirm the MCP clients, servers, credential flow, and rollout pressure so the review stays narrow and decision-ready.

Hours 1-24: configuration and exposure review

Inspect MCP configs, tool permissions, obvious secrets exposure, prompt injection paths, supply chain risk, and network egress assumptions.

Hours 24-48: remediation memo and decision

Return a prioritized memo with a clear go, fix, or escalate recommendation and the shortest safe next move.

If the review finds something to fix

A scoped fixed-price engagement where ThynkQ fixes what the MCP Risk Review finds: rotate exposed secrets, correct tool permissions, patch config and transport issues, and re-verify with a follow-up scan.

$15,000, 2 weeks. Priced on the existing Rescue Sprint shape ($15,000, 2 weeks): remediation is bounded, scoped implementation on one system, not a new number invented for this lane.

Fixes scoped directly from the review findings memo, prioritized by severity
A follow-up mcp-scan run to confirm findings are closed
Written confirmation of what changed and what remains an accepted residual risk

Scope is set from the review findings, not committed blind before the review runs. If findings are broader than the MCP surface, the honest next move is a Build Readiness Audit instead of forcing this into a fixed-price sprint.

Discuss MCP Remediation scope

If the review finds broader risk

The honest next move is a deeper Build Readiness Audit or a full Product Build, depending on whether the problem is clarity-first or implementation-first. This lane exists to stop small MCP mistakes from turning into larger security or delivery failures.

Review Build Readiness Audit Request MCP Risk Review