MCP Auth Hardening Sprint
A fixed-price review of your remote MCP server's OAuth, tenant isolation and webhooks. You get a written report and pull requests that fix what we find, in 5 business days.
Active testing only with your written authorization.
The problem
Remote MCP servers put an OAuth authorization server in front of your users' data. Most teams built one quickly, on top of a spec that was still moving. Independent research shows the result.
Source: Zhou et al., "A First Measurement Study on Authentication Security in Real-World Remote MCP Servers", arXiv 2605.22333, May 2026.
These are not theoretical. Obsidian Security documented a one-click account takeover through consent bypass in MCP servers that proxy OAuth, including Square's MCP server: a user who had authorized it once could be taken over by clicking a single link.
Pricing
| Tier | Price | What it includes |
|---|---|---|
| Auth Snapshot | $750 | Written findings only, from passive review of your public metadata and endpoints plus anything you authorize. The fee is credited toward the Full Sprint. Pay $750 |
| Full Sprint | $2,500 5 business days |
OAuth 2.1 end to end: DCR redirect-URI validation, consent bound to the browser session, PKCE, state, token audience and refresh, revocation. Tenant isolation. Tool annotations and prompt-injection surface. Webhook fail-open. Delivered as a report plus fix pull requests against your repo, with a free retest within 30 days. Pay $2,500 |
| Connector build add-on |
from $4,900 | A directory-ready MCP connector built for your product. Scoped on a call. Ask about a build |
Fixed prices, no hourly billing. Work starts after payment and a signed authorization and scope form.
What's included, and what isn't
Included
- Review of your authorization server, protected-resource metadata and MCP endpoint
- DCR: redirect-URI schemes, exact matching, client metadata shown on consent
- Consent: bound to the user's browser session, CSRF-protected, short-lived
- PKCE, state, code reuse, token audience, refresh rotation and reuse detection, revocation
- Tenant isolation in tool calls
- Tool annotations (read-only, destructive) and where untrusted content reaches the model
- Webhook signature checks and fail-open configuration
- Fix pull requests with tests, a written report, a readout call, one retest within 30 days (Sprint)
Not included
- No guarantee of directory approval. Anthropic and other directories run their own reviews.
- Not a compliance certification. This is not SOC 2, ISO 27001 or a formal penetration-test attestation.
- No active testing without written authorization. Before any active testing you sign a short authorization and scope form naming the systems, accounts and time window.
- No load or denial-of-service testing, social engineering, or testing of third-party systems you don't own
- We don't merge or deploy. You own the fixes and decide what ships.
Case study: our own MCP server
Oryah Mail is our remote MCP server for governed email and calendar access. It is listed as a community connector in Claude's Connectors Directory and in the official MCP Registry as com.infinihash/oryah-mail. It uses OAuth with dynamic client registration and PKCE.
In October 2026 our own review agents went through it the way we would go through yours. They found three bug classes:
- Consent bypass. A pending authorization request could be completed without being tied to the browser that started it, so a crafted sign-in link could issue a code to a client the user never approved.
- Unsafe DCR redirect URIs. Client registration accepted
javascript:,data:and plainhttpredirect URIs. - Webhook fail-open. The Stripe webhook would have skipped signature verification if its secret were empty. This was latent: the production secret was set.
All three were fixed in v24, deployed on October 14, 2026. Consent is now bound to the browser with an HttpOnly cookie and requires an explicit, CSRF-protected approval; pending requests expire after 10 minutes; DCR accepts only https redirect URIs (or http on a loopback address), with no fragments or embedded credentials; and with no webhook secret configured, every webhook is now rejected and checkout is disabled. An audit of issued OAuth tokens found no evidence the consent bypass was exploited.
The same review found and fixed other issues too. We tell you this because it's the honest version: we built a server, missed things, and found them before anyone else did. That is the job we're offering to do for you.
How the 5 days run
- Before20-minute scoping call. You sign the authorization and scope form and give us a test environment, two test accounts in separate tenants, and read access to the repo.
- Day 1Discovery and metadata, DCR and redirect-URI validation, client metadata on the consent screen.
- Day 2Authorize and consent flow, browser binding, PKCE, state, code handling, token audience, refresh and revocation.
- Day 3Tenant isolation across tools, tool annotations, and where untrusted content reaches the model.
- Day 4Webhooks and fail-open configuration. Fix pull requests opened against your repo, with tests.
- Day 5Written report and readout call. Critical findings are reported the day we confirm them, not on day 5.
- Within 30 daysFree retest once you've merged and deployed.
FAQ
- Will you test our production server?
- Only if you authorize it in writing. Nothing active happens before the authorization and scope form is signed. A staging environment with test accounts is preferred.
- What does the Snapshot look at without authorization?
- Public information only: your OAuth and protected-resource metadata, registration and authorization endpoints as any client would see them, and your documentation. Anything beyond that needs the signed form.
- Does this get us into the Claude Connectors Directory?
- No one can promise that. Directory review is run by Anthropic. We fix the authentication issues that commonly come up, but approval is not guaranteed.
- Is this a compliance certification or a pen-test attestation?
- No. It is a focused security review with fixes. It is not SOC 2, ISO 27001 or any other certification.
- How is the work done?
- With AI agents doing much of the review and drafting, the same way we reviewed Oryah Mail. A person reviews every finding and every pull request before you see it.
- What stacks do you support?
- Fix pull requests are written for TypeScript and Python servers, including those built on the official MCP SDKs. For other stacks, tell us on the call; the report will still include fix guidance.
- Who owns the fixes?
- You do. Pull requests are opened against your repository and you decide whether to merge them.
- What about confidentiality?
- Findings, code and credentials stay confidential. We never publish anything about your server without your written permission. Test credentials are deleted at the end of the engagement.
- Is the Snapshot fee really credited?
- Yes. If you book the Full Sprint after a Snapshot, the $750 comes off the $2,500.
Talk to us
Email [email protected] with your server's URL and a time that suits you, and we'll set up a 20-minute call.