MCP endpoint observations.
The paid security-audit offer is paused. The sample and free self-check remain available.
Our automated probe observes TLS, response headers, initialization and public tool metadata. It does not establish whether a tool can be executed without permission, whether a server validates inputs correctly, or whether a complete system is secure.
Correction published September 8, 2026
The earlier sample described public tool discovery as a high-severity execution vulnerability. The collected evidence did not support that claim. Public discovery and tool execution are distinct operations. Wildcard CORS also did not establish an authentication bypass.
We removed those unsupported conclusions and the automated malformed requests. The current probe sends discovery requests only. Any deeper security testing requires an explicitly agreed scope and evidence for each claimed impact.
Do not send payment for the former $79 audit. For an existing order or a specific integration failure, contact us privately.