Inventory
Reachable MCP servers, tools, versions, transports, owners and third-party dependencies in the agreed workflow.
MCP · identity · policy · effect
Know which tools your agents can call — and which calls sit outside the boundary you think you have.
BitEvo reviews one representative agent-to-tool workflow and returns an inspectable map of reachable tools, consequential actions, acting identity, policy coverage, approval gates, failure behavior and evidence gaps.
2026 protocol surface
The transport became easier to route. Governance still has to be designed.
MCP 2026-07-28 moved to a stateless protocol core and made Mcp-Method and Mcp-Name required for Streamable HTTP requests, making method/tool routing visible to gateways. The authorization model also requires resource/audience-bound tokens and forbids forwarding the inbound MCP token unchanged to downstream APIs.
Review areas
Map the actual execution boundary.
The audit does not assume that installing a gateway, SDK or MCP server automatically governs every path. We test the agreed path and keep bypasses and untested surfaces visible.
Action class
Separate read-only tools from durable writes, deletes, external communication, deployment, credential and other high-consequence actions.
Identity & auth
Map the acting identity, credential audience/resource binding, scope, lifecycle and any token-passthrough assumptions.
Gateway boundary
Identify which calls cross the expected policy/gateway surface, which paths bypass it, and the default for unknown tools.
Approval
Check whether consequential approval is bound to the exact action, target and material parameters, expires, and is single-use where required.
Failure & evidence
Exercise bounded timeout/retry/replay cases and determine whether actor → decision → tool → effect can be reconstructed.
Bounded test set
Test decisions, not slogans.
The exact cases depend on the client's workflow and Rules of Engagement.
- 01Expected allowed read succeeds and is evidenced
- 02Expected denied or held consequential action does not execute
- 03Approval-required action cannot run before valid approval
- 04Changed parameters invalidate stale approval where required
- 05Unknown or unregistered tooling follows the intended default policy
- 06Revoked or expired credential cannot continue acting
- 07Timeout/retry does not blindly duplicate a material effect
- 08Evidence can reconstruct actor → decision → tool → resulting state
Delivery
Engineering evidence.
MCP/tool inventory, action matrix, identity/credential map, gateway/bypass map, bounded test results, evidence gaps and prioritized remediation.
Claim boundary
Not a universal security score.
No full penetration test, certification, legal compliance opinion or guarantee that every MCP server or tool path is secure.
Start narrow
Bring one agent-to-tool path that matters.
The public intake prepares scope only. It does not authorize testing and must not contain credentials or customer secrets.
Prepare scope brief