FIRST ENGAGEMENT

AI Agent & MCP Inventory

Know what your AI agents can reach before someone else finds out.

A one-week, fixed-fee inventory of the AI agents running in your environment, the MCP servers they connect to, the tools they can call, and the credentials and permissions they hold. Human-led, read-only, and delivered as a report your security leader can take to the board.

Book a Consultation Scope via Intake Talk to the Founder

◆ The Gap

Most Teams Can't List Their Agents.

AI agents went into production faster than anyone wrote them down. Developers connect coding assistants to MCP servers. Teams ship agents with API keys and cloud roles attached. Each one can call tools and take actions on its own, and most security teams have no list of what exists, what it can touch, or whose credentials it uses.

"What can our AI agents actually do, and with whose access?"

→ That is the engagement.

◆ What We Cover

Four Questions. One Week.

What agents you run, what they connect to, what they can do, and what access they hold.

AI Agents

Agents built on cloud AI services, agents running in your own workloads, and agents set up inside SaaS tools. Who owns each one, what model it uses, what triggers it, and what data it reads.

MCP Servers

The MCP servers your agents and developer tools connect to. Where each one is configured, who installed it, whether it is first-party or a third-party dependency, and what it exposes.

Agent Tools and Autonomous Actions

Every tool each agent can call, sorted by what it can do: read, write, delete, or send data outside the company. Which of those actions run without a human approving them.

Credentials and Permissions

The API keys, tokens, and cloud roles each agent holds, what those permissions reach, when they were last used, and whether they rotate. We record names and scopes only. We never collect secret values.

◆ Pricing

One Week. One Fixed Fee.

AI Agent & MCP Inventory

$9,500

1 week. One AWS account. AI services are checked across all enabled regions. Also covers developer tool configurations and SaaS agents identified through interviews with the teams that build and run them. Read-only access. Report and live walkthrough included.

◆ What You Walk Away With

Deliverables

Agent inventory: every agent found, its owner, and what it touches
MCP server inventory, including third-party servers and who installed them
Tool and permission map: each agent, the tools it can call, the credentials behind them, and what they reach
Fix-first list: the agent and access combinations that need attention first
Plain-language summary your security leader can take to the board
Live walkthrough of the findings with the founder

◆ See a Sample

Read the Report Before You Buy It.

Sample AI Agent & Access Inventory

A 17-page example of the report format, built for a fictional company. It shows how we present agents, the access they hold, and what the method could not see.

Executive summary written for the board
Coverage table showing what was checked and what was not
Agent findings with severity and the access behind each one
Asset inventory and methodology

Fictional data. No real organization represented.

Sent.

The sample report is on its way to . If it is not there in a few minutes, check your spam folder.

◆ The Shape

How the Engagement Works

Format

Fixed scope, fixed fee. Read-only access. Nothing left running in your environment.

Duration

One week. Report and walkthrough within five business days of access.

Delivery

Founder-led. Senior-level delivery. No junior handoffs.

◆ The Next Step

Then Test the Riskiest Agents.

The inventory shows which agents and access combinations need attention first. Your team can work the fix-first list directly, or we can test the riskiest agents by hand to show what an attacker could actually make them do.

See AI Penetration Testing →

Start with the Inventory

Tell us where your AI agents run. We will confirm scope and access, and start within the week.

Book a Consultation Or send us the details