Get your MCP server assessed in 48 hours
Regulatory Signals is an independent technical evaluation provider. This product is not an accredited certification under ISO/IEC 17065 or ISO/IEC 17021. Evaluation findings are technical assessments, not regulatory endorsements or legal opinions.
10 MCP-specific security rules. Signed assessment report. Public registry listing. Enterprise security teams use our allowlist as the source of truth for approved MCP servers.
npm or GitHub URL · Badge for your README · Continuous monitoring — coming soon
10 MCP vulnerability rules
OWASP LLM Top 10 (2025) aligned · CWE mapped
CWE-1336 · LLM01
CWE-78
CWE-918 · LLM06
CWE-200 · LLM02
CWE-269 · LLM06
CWE-400
CWE-367
CWE-862 · LLM06
CWE-404
CWE-345
What you receive
Everything included in the $499 one-time audit.
Signed certificate
- HMAC-SHA256 tamper-evident cert JSON
- Trust grade: Gold / Silver / Bronze / None
- Security score 0–100
- Machine-readable /api/mcp-cert/{slug} endpoint
- Badge embed code for README
Audit findings report
- All 10 rules checked against your source
- Per-finding severity: CRITICAL / HIGH / MEDIUM
- CWE and OWASP LLM Top 10 mapping
- Remediation guidance per finding
- Public MCP Trust Registry listing
Pricing
One payment. Results in 48 hours. No subscription.
Frequently asked questions
What does an MCP server audit cover?
10 rules covering: prompt injection in tool descriptions (mcp-001), command injection via exec/spawn (mcp-002), SSRF in fetch-style tools (mcp-003), secret leak via env-readback (mcp-004), capability escalation (mcp-005), missing rate-limit/timeout (mcp-006), TOCTOU race in file tools (mcp-007), missing auth on resources/list (mcp-008), zombie subprocess on close (mcp-009), and unverified manifest signing (mcp-010). Mapped to OWASP LLM Top 10 (2025) and CWE.
How long does the MCP audit take?
Source fetch and rule analysis complete in under 10 minutes. You receive a signed certificate JSON and public registry listing within 48 hours after any manual review pass.
What does the signed certificate include?
A tamper-evident HMAC-SHA256 certificate with: MCP server slug, npm package, version audited, security score (0-100), trust grade (gold/silver/bronze/none), issuance date, and a machine-readable endpoint at /api/mcp-cert/{slug} for IDE badge integration.
Will there be continuous monitoring?
Continuous monitoring (auto re-audit on new npm versions, score drift alerts) is on the roadmap. The one-time audit + cert is available now at $499.
Enterprise teams are building allowlists now
Security teams at companies deploying Claude with MCP use our registry to manage approved server lists. Get your server assessed before they build the allowlist without you.
You might also need
Fingerprint every cookie, tracker, and legal-page gap on your site.
View productEU AI Act risk classification from your repo — not from checkboxes.
View productSecrets, vulns, OWASP risks, invalid AI model IDs, and false feature claims.
View product