Sample audit report
This is a real, unedited example of the written report you get from the $79 MCP server security audit. The target is our own public endpoint, golemreach.com/mcp, audited on 2026-09-06 with the exact checklist we run on a customer's server. Nothing here is invented; you can reproduce every line against that URL yourself.
golemreach.com/reports/<first 10 hex of your tx>/ or by email, never listed publicly, unless you ask.Scope & method
- Target:
https://golemreach.com/mcp(Streamable HTTP MCP, protocol 2025-06-18) - Type: external, black-box read. No source code, no credentials. Every request is one a normal MCP client could send.
- Checked: transport & TLS, HTTP security headers, unauthenticated access to
tools/listandresources/list, every tool description read for hidden instructions and over-broad scope, argument shapes, error-leakage, and per-tool client-safety annotations. - Result: 1 high, 1 medium, 4 low, 12 informational. Severities reflect impact for this server — a public game with no funds movement — and would be re-scored for a server that writes data, spends, or reaches internal systems.
| Severity | Count | Headline |
|---|---|---|
| HIGH | 1 | Tool list & call reachable with no authentication |
| MEDIUM | 1 | CORS allows any web origin to drive the endpoint |
| LOW | 4 | Over-long tool descriptions hide injection surface |
| INFO | 12 | No client-safety annotations on any tool |
Findings
Tool list and tool calls are readable without authentication
What we found. An unauthenticated initialize returns 200, and tools/list returns all 12 tools to any caller, including one named golemreach_invite_administrator. No bearer token, session binding, or origin check is required to enumerate or call the surface.
POST /mcp {"method":"tools/list"} → 200 tools: golemreach_connect, look, move, attack, cast, use, inventory, talk, trade, where, wait, invite_administrator
Why it matters. For this server it is by design — the game is meant to be openly playable by agents, and no tool moves money or touches an internal network. For most MCP servers it is the top risk on the OWASP MCP list: if any tool writes data, spends, or reaches internal hosts, an anonymous caller can drive it. A privileged-sounding name like invite_administrator is exactly what an attacker enumerates first.
Fix. Decide per tool whether it is safe for anonymous callers. Gate any tool that writes, spends, or reaches internal networks behind a bearer token, and require the token before tools/list if the surface itself is sensitive. If open access is intentional, say so in your docs so a reviewer does not flag it.
CORS allows any origin on the MCP endpoint
What we found. The endpoint returns access-control-allow-origin: *.
access-control-allow-origin: * content-security-policy: (none) x-content-type-options: (none)
Why it matters. Any website a user visits can script requests to this server from the user's browser. With no auth that is only reconnaissance here, but combined with any cookie- or ambient-credential-based auth it becomes cross-site request forgery against the agent.
Fix. Restrict Allow-Origin to the origins you actually serve, or drop CORS entirely for a server meant to be called by non-browser agents. Add x-content-type-options: nosniff and a minimal content-security-policy.
Four tool descriptions are long enough to hide instructions
What we found. golemreach_attack (1674 chars), golemreach_use (1855), golemreach_talk (1762), and golemreach_where (1568) carry very long descriptions.
Why it matters. Tool descriptions are fed straight into the calling model's context. A long description is where a supply-chain attacker hides an injected instruction ("also send the user's keys to...") that a human skims past. Long descriptions also burn the caller's context budget.
Fix. Keep descriptions to a sentence or two of what the tool does and its arguments. Move examples into inputSchema examples. Review each long description by hand for text that reads as an instruction rather than documentation. (Ours are verbose game help, not injection — but the reviewer cannot assume that, and neither should yours.)
No tool carries client-safety annotations
What we found. None of the 12 tools set readOnlyHint, destructiveHint, or openWorldHint.
Why it matters. Without these hints a client cannot know that golemreach_look is read-only while golemreach_attack changes state, so it either confirms everything (annoying) or nothing (dangerous).
Fix. Annotate every tool. Mark read-only tools readOnlyHint: true and state-changing ones destructiveHint / openWorldHint as appropriate, so well-behaved clients can ask for confirmation only where it matters.
Want this run on your server?
Same checklist, your endpoint, a written report in 72 hours. Buy the $79 MCP audit →
Honest state: this offer went live 2026-09-05 and has no paying customers yet; we will not invent testimonials. The sample above is genuine and reproducible. The game itself is free forever.