FusionFive business days · read-only
An independent look at what your agents can reach.
The MCP Access Audit reviews one workflow you choose, where an AI agent or MCP tool touches your systems. It maps what the agreed evidence shows each credential can reach, then records observed gaps, limitations, and what remains unverified. The review is read-only and does not assume a problem before examining evidence.
Five business days start after the workflow, inventory limits, and required evidence are agreed and available. If the inventory exceeds an agreed limit, we pause and agree any revised scope, schedule, and fee before expanding the review. We confirm fit and written scope before arranging payment. Download the scope overview.
What the audit looks at.
Bounded to one agreed workflow, environment, inventory, and evidence period. The review is read-only; no configuration is changed.
01
What each credential authorises
At server, tool, and parameter level: what the inspected configuration shows each credential can do, within the agreed workflow.
02
Scope against the task
Whether the permissions we can inspect appear broader than the agreed workflow requires, with each observation tied to its evidence and limits.
03
What the audit trail can answer
What the agreed log sources can show about identity, permission, and action, including attribution or retention limits.
What you get.
- Permission map for one agreed workflow: what each credential authorises, at server, tool, and parameter level
- One-page executive summary plus a supporting permissions and evidence appendix
- Evidence-backed observations, including observed access-control gaps, client-reported statements, and items that were not observable
- Prioritized actions tied to the evidence, plus a 30-minute findings walkthrough
Not included.
- Penetration testing or exploit development
- Remediation work (implementation is a separate engagement, from $5,000)
- Vendor selection, continuous monitoring, or incident response
- Certification, legal opinion, or assurance over systems or traffic not observed
- Runtime assurance, production attack testing, or a guarantee of completeness or security
MCP Access Audit
$2,500
Fixed price, five business days after agreed access is available, one workflow. A live or imminently deployed agent/MCP workflow and a named owner are required. Confirm scope before payment.
Have a usable baseline and recurring changes to review? Consider the Agent Ops Retainer. Questions: book a call or email jrm@fusional.dev.