Agents, servers & tools
Inventory the agreed workflows, MCP servers, tool manifests, identities, owners, and trust boundaries.
Back to servicesWHAT WE REVIEWFollow the action.
HOW IT WORKS 
01 / Executive view
02 / Priority finding
03 / Fix & verify
Read the full comparison SCOPE / ACCESS / NEXT STEPS START WITH ONE WORKFLOWFind out what your agents
MCP READINESS & SECURITY ASSESSMENTSecure the agents.
Secure the agents.
Prove the controls.
Know what your agents can reach, what they can change, and whether oversight holds. Leave with a practical plan to fix what matters first.
Human-led. Fixed scope, agreed before work begins.
Price, delivery window, and access confirmed in writing.
READINESS SCORECARD
ILLUSTRATIVEControls you can explain.
Permissions1 / 3 Defined
Data Access1 / 3 Defined
Oversight1 / 3 Defined
Evidence2 / 3 Verified
Response0 / 3 Absent
Fictional example, not a client result. Unknown evidence is marked separately. No aggregate pass/fail score.
What is the MCP Readiness & Security Assessment?
A human-led, fixed-scope review of AI agent and MCP permissions, data access, approval gates, execution evidence, and response readiness. Receive a readiness scorecard, prioritized findings, an owner-assigned fix plan, and a reviewable evidence pack. Scope, price, timing, and access are agreed in writing before work begins.
WHO IT’S FORShipping agents?
Shipping agents?
Make the boundaries a decision.
For small and mid-size teams moving an AI agent or MCP integration toward production, or preparing for a customer security review.
- You need to understand tool and data access before launch.
- You need evidence of human oversight and permitted behavior.
- You need a bounded fix plan your team can own.
A focused review can sit alongside your existing security tools and internal team.
Follow the action.
Check every boundary.
Permissions & credentials
Review effective scopes, credential handling, and the gap between intended access and permitted actions.
Data access paths
Trace sensitive inputs, retrieval sources, tool outputs, and destinations across the workflow.
Approval & oversight
Check who may approve, what they see, and whether the exact approved action is enforced at execution.
Evidence & response
Review useful traces, failure handling, access revocation, incident ownership, and recovery checks.
Start with the least access needed. Redacted exports and screen shares first; scoped read-only access when necessary. Tests and any changes require a separately agreed environment and authorization.
WHAT YOU GETA scorecard.
A scorecard.
A fix plan.
The evidence behind both.
- 01 / Readiness Scorecard
- Permissions · Data Access · Oversight · Evidence · Response. Every level points to evidence or an explicit gap.
- 02 / Prioritized findings
- Risk paths ranked by impact and reach. For example: sensitive data + broad write access + an unenforced approval gate.
- 03 / Owner-assigned fix plan
- Recommended changes, a proposed owner to confirm with your team, effort estimates, dependencies, and acceptance checks.
- 04 / Evidence pack
- A redacted inventory, configuration references, test records, and limitations for your customer or auditor to review.
READINESS SCORECARD
ILLUSTRATIVEControls you can explain.
Permissions1 / 3 Defined
Tool manifest reviewed; the CRM identity still allows broader writes than the workflow needs.
Data Access1 / 3 Defined
Data sources mapped; an export path still reaches customer contact fields.
Oversight1 / 3 Defined
A review screen exists; approval is not bound to the exact action at execution.
Evidence2 / 3 Verified
Sample test traces link the proposed action, execution decision, and observed result.
Response0 / 3 Absent
The sample runbook has no named owner for revoking the agent’s access.
Fictional example, not a client result. Unknown evidence is marked separately. No aggregate pass/fail score.
What the levels mean
0 / AbsentThe agreed control is confirmed missing.
1 / DefinedA control is documented or configured; behavior is not yet verified.
2 / VerifiedThe agreed positive and negative checks have recorded results.
3 / ExercisedThe control has also been exercised through an agreed failure or recovery scenario.
Unknown / Not assessedInsufficient evidence or outside the agreed scope. Never silently counted as a zero.
A scoped evidence review, not a certification or guarantee of audit acceptance.Agree the scope. Verify the result.
- 01
Discover
Agree the workflow, systems, decision, and access boundary.
Written scope + evidence request - 02
Assess
Review configuration and run only the checks you authorize.
Evidence-linked observations - 03
Report
Walk through risk paths, unknowns, and what to fix first.
Scorecard + fix plan + evidence pack - 04 / OPTIONAL
Harden
Optionally implement agreed changes and verify the result.
Separately scoped implementation
THE SAMPLE / NO EMAIL REQUIREDInspect the deliverable.
FICTIONAL WORKFLOW · 3 PAGESInspect the deliverable.
Before you commit.
An illustrative CRM-agent assessment with withheld identifiers. It shows the format and reasoning you can expect. It contains no client data or engagement results.
01 / Executive viewA decision, with its limits.
Scope, readiness levels, and the first action to take.
02 / Priority findingSee the whole risk path.
A sensitive data source, a write-capable tool, and an unenforced approval.
03 / Fix & verifyKnow what done looks like.
Named owners, estimated effort, and a concrete acceptance check.
ASSESSMENT + PLATFORM
Different jobs. A stronger whole.
A CNAPP supports an ongoing cloud security program. This engagement examines a named agent workflow and its controls at a point in time. Choose based on the decision you need to make.
| Your need | This assessment | A CNAPP platform |
|---|---|---|
| Primary question | What can this agent workflow do, and which controls can we verify? | What is happening across our cloud estate, and where is risk concentrated? |
| Scope & cadence | A named set of workflows, reviewed at an agreed point in time. | Continuous posture and runtime coverage across supported environments. |
| What you receive | Scorecard, prioritized fix plan, evidence, and an optional hardening phase. | Asset inventory, findings, monitoring, and response capabilities that vary by product. |
| Best fit | A launch decision, customer review, or focused check of agent boundaries. | An ongoing cloud security program with broad operational coverage. |
Before we start.
Do we need this if we already have a CNAPP or cloud scanner?
Possibly. Start by checking what your existing platform already covers. This assessment focuses on a bounded agent workflow: effective tool permissions, sensitive data paths, enforced approval, and execution evidence. It can complement continuous cloud monitoring. If your current team and tools already verify those controls, a separate assessment may add little.
What access do you need, and is it read-only?
Discovery starts with redacted architecture, tool manifests, permission policies, and representative traces. Prefer customer-provided exports, a screen share, or scoped read-only access. Any behavior testing uses an agreed test environment and explicit authorization. Production writes, credentials, and hardening are never assumed to be included.
How long does an assessment take, and what do we get?
The delivery window and price are agreed after a fit conversation, once the number of agents, servers, workflows, and test cases is clear. The fixed scope includes a five-dimension readiness scorecard, prioritized findings, a fix plan with owners and effort estimates, and an evidence pack. Missing evidence and untested areas are identified explicitly.
Can you help fix the findings, or just report them?
Hands-on hardening can be agreed as a separate phase. That may include narrowing tool permissions, binding approval to the exact proposed action, improving trace evidence, and exercising access revocation. Each change has an owner, acceptance checks, and agreed access before implementation.
Is the Readiness Scorecard a certification?
No. It is an engagement-specific view of evidence across Permissions, Data Access, Oversight, Evidence, and Response. Levels run from 0 (confirmed absent) to 3 (exercised). Unknown means insufficient evidence; it is not a zero. Scores describe the agreed scope and observation date, not a guarantee of security, compliance, or audit acceptance.
How do we book an assessment?
Send an assessment inquiry with the workflow you are shipping, the connected tools, and the decision you need to make. Malik replies by email to discuss fit and arrange a scoping conversation. The engagement begins after both sides agree on scope, access, timing, price, and acceptance criteria in writing.
Find out what your agents
can actually do.
Bring the connected tools, the workflow you’re shipping, and the decision you need to make. I’ll reply by email to discuss fit and arrange a conversation.