MCP Risk Review

48-hour MCP security decision before an avoidable rollout mistake.

Founder-led narrow review for teams already connecting MCP into sensitive AI workflows and wanting a clear go, fix, or escalate decision fast.

Fixed investment: $3,000. Typical duration: 48 hours.

An AI supply-chain and MCP security review: 16 scanners read and prioritized by a person, not an automated report forwarded unread. If the review finds something to fix, remediation is a separate scoped engagement, never bundled into this fixed scope.

Started from: mcp-scan proof surface. That context will stay attached if you preview the brief or request the review from here.

Request MCP Risk ReviewPreview one-page buyer brief

Prefer an async path? Request async risk review or explore the fit-call option. Reserve the narrow lane if the MCP problem is already clear. If the risk is broader than one MCP decision, escalate into a Build Readiness Audit instead of forcing this fixed-scope review. Open the mcp-scan proof surface first if you want to inspect the public proof path before you start.

What you get in the 48-hour review

  • 48-hour manual review of MCP configs, tool permissions, and obvious exposure paths
  • Prioritized remediation memo across secrets, prompt injection, supply chain, and network egress risk
  • Clear decision: safe to proceed, fix before rollout, or escalate into a deeper Build Readiness Audit

Best fit when

  • You are already connecting MCP servers or AI tool clients into a real workflow
  • One bad configuration could leak secrets, over-expand permissions, or create rollout risk
  • You need a fast human decision before a broader implementation or security project starts

Not fit when

  • You are not using MCP yet
  • You need a full application security program instead of a narrow MCP decision
  • The work already includes broad architecture risk that belongs in a Build Readiness Audit

If the risk is broader than MCP configuration and permissions, move into Build Readiness Audit.

What this review covers

  • Manual review of MCP client and server configurations, tool permissions, and credential flow
  • mcp-scan CLI findings across its 16 scanner modules, read and prioritized by a person before anything reaches the memo
  • Prompt injection, secrets exposure, supply-chain, and network egress risk on the MCP surface in scope

What this review does not cover

  • Network penetration testing or a red-team engagement
  • SOC 2, ISO 27001, HIPAA, or any other compliance certification or attestation
  • A full application security code audit beyond the MCP surface, that belongs in a Build Readiness Audit instead

mcp-scan flags patterns, not confirmed exploits. Some findings will be false positives, and its precision and recall have not been independently published yet, including our own false-positive rate. See the research ledger.

How the 48 hours run

Hour 0: scope lock

Confirm the MCP clients, servers, credential flow, and rollout pressure so the review stays narrow and decision-ready.

Hours 1-24: configuration and exposure review

Inspect MCP configs, tool permissions, obvious secrets exposure, prompt injection paths, supply chain risk, and network egress assumptions.

Hours 24-48: remediation memo and decision

Return a prioritized memo with a clear go, fix, or escalate recommendation and the shortest safe next move.

If the review finds something to fix

A scoped fixed-price engagement where ThynkQ fixes what the MCP Risk Review finds: rotate exposed secrets, correct tool permissions, patch config and transport issues, and re-verify with a follow-up scan.

$15,000, 2 weeks. Priced on the existing Rescue Sprint shape ($15,000, 2 weeks): remediation is bounded, scoped implementation on one system, not a new number invented for this lane.

  • Fixes scoped directly from the review findings memo, prioritized by severity
  • A follow-up mcp-scan run to confirm findings are closed
  • Written confirmation of what changed and what remains an accepted residual risk

Scope is set from the review findings, not committed blind before the review runs. If findings are broader than the MCP surface, the honest next move is a Build Readiness Audit instead of forcing this into a fixed-price sprint.

Discuss MCP Remediation scope

If the review finds broader risk

The honest next move is a deeper Build Readiness Audit or a full Product Build, depending on whether the problem is clarity-first or implementation-first. This lane exists to stop small MCP mistakes from turning into larger security or delivery failures.

Review Build Readiness AuditRequest MCP Risk Review