null.select
ConsoleAssess a server freeFree check

Free MCP risk assessor · Managed read-only gateway

Know what an MCP tool can do before your agent does.

Enter a public HTTPS MCP endpoint or paste a tools/list. Get a deterministic risk report with exact locations and repairs. Free, in seconds, nothing stored. Then run the reads you approve through a managed gateway that records who called what, under which release, with what result.

Assess an MCP server free How the managed gateway works

no account URLs and definitions never stored the same rules the gateway uses for release review

tools-list.json · customer-support-mcp · 1 tool report asmt_534c1d6b · 7 findings
  1. {
  2. "name": "send.customer",
  3. "description": "Send customer data to an approved destination",
  4. "inputSchema": {
  5. "type": "object",
  6. "properties": {
  7. "callback_url": { "type": "string" },
  8. "api_token": { "type": "string" }
  9. }
  10. },
  11. "annotations": {
  12. "readOnlyHint": false,
  13. "destructiveHint": false,
  14. "idempotentHint": false,
  15. "openWorldHint": true
  16. }
  17. }
Review required1 high · 3 medium · 3 low
  • mediumMCP-SCHEMA-004
    Undeclared inputs are not rejectedUnexpected arguments can bypass review assumptions or reach permissive upstream mappings.
  • mediumMCP-NET-001
    callback_url chooses a network destinationCaller-controlled destinations enable SSRF, exfiltration, open redirects, and credential forwarding.
  • highMCP-DATA-001
    api_token accepts a credentialSecrets passed as model-visible arguments leak through prompts, logs, traces, and tool history.
  • mediumMCP-ANN-005
    Write-like tool is not idempotentA retry after a lost response may repeat an external effect.
3 low findings and 5 runtime controls marked not observable in the full report.Run yours

Generated by the production assessment rules, schema 2026-10-12, for the definition shown.asmt_534c1d6bc68228aecd3a9eb7

1 · request.receivedprev → 90442580e2…
2 · release.resolvedprev → 522e864193…
3 · input.validatedprev → 9a69b069cd…
4 · policy.allowedprev → 68f7f88961…
5 · credential.resolvedprev → 47e36fe358…
6 · dispatch.startedprev → 286e5c3a9f…
7 · dispatch.completedprev → 336783b6e2…
8 · output.validatedprev → 2d369a531d…
9 · response.deliveredprev → ed92713c85…

The event types written for one successful read, in order. Each event stores the hash of the one before it; digests shown here are illustrative.

Two surfaces, one boundary

Free to look. Managed when it matters.

Free · no account

Assess any MCP server's tool surface

Enter a public HTTPS endpoint for one metadata-only observation, or paste the tools/list response your client already receives. The engine reads names, descriptions, schemas, and annotations, and returns findings you can act on. Endpoint mode never calls a tool.

  • Stable codes and severities across eight rule families.
  • Exact document location for every finding, down to the property.
  • Observed, why, repair on each finding, written for the person fixing it.
  • Honest coverage. Runtime controls it cannot see stay marked not observable.
  • Export JSON for tickets and before-and-after comparison.
Open the assessor Read the quickstart
Managed · per organization

Run the reads you approve through one enforced boundary

Your assistant connects to a managed MCP endpoint. It can discover and call only reviewed read-only tools, and every call leaves a hash-linked record.

  • Identity from the access grant, never from the model or a header.
  • Signed, immutable release per organization, verified on every request.
  • Immutable source observations with scheduled checks, semantic diffs, and explicit accept-or-dismiss review before any revision changes.
  • Nine retained candidate gates around the live call before signed publication and separate activation.
  • Recorded rollback to an earlier signed release without rewriting history.
  • Versioned environment policy profiles for the complete reviewed boundary, public anonymous reads, or authenticated business-data reads, with deterministic comparison before binding or activation.
  • Per-member upstream OAuth bound to one member, environment, and source, without token passthrough or fallback to shared authority.
  • Immediate reversible stops for an organization, source, environment, tool, principal, or credential, with immutable operator history.
  • Fixed destination and validated output under release-defined limits.
  • Guided and Advanced views over the same controls and evidence: clear next actions by default, exact operational detail on demand.
  • Hash-linked execution evidence without secrets or raw payloads, plus owner-readable signed packets that the open-source CLI verifies offline.
Request managed accessSee the enforced workflow

What the report checks

Eight rule families. No guesswork.

Every rule is deterministic and explainable. The same definition always produces the same findings, and each finding names the line that triggered it.

MCP-CAP-*up to high
Dangerous capability

Names that imply shell, code, command, or SQL execution.

MCP-DATA-*up to critical
Credential exposure

Inputs that look like secrets, and secrets mirrored into HTTP headers.

MCP-NET-*up to medium
Destination control

Inputs that let the caller choose a URL, host, callback, or webhook.

MCP-DESC-*up to critical
Prompt injection

Instruction-like text in descriptions that tries to override user or system intent.

MCP-ANN-*up to high
Effect declarations

Missing, contradictory, or understated read-only, destructive, idempotent, and open-world hints.

MCP-SCHEMA-*up to high
Schema posture

Missing or invalid input schemas, open additionalProperties, and absent output schemas.

MCP-NAME-*up to high
Name integrity

Invalid names and lookalike tools that a model could confuse.

MCP-SERVER-*up to medium
Surface breadth

Empty lists and oversized tool surfaces that widen the blast radius.

The managed read

One read. Nine linked events. No raw payloads.

The gateway writes an audit event at every control point, each carrying the hash of the one before it. The client receives the execution identifier, the release digest, and the chain tip together with the result.

#eventwhat is recorded
  1. 01request.received

    Authenticated organization, principal, client, tool name, and a digest of the arguments.

  2. 02release.resolved

    Release identifier, its SHA-256 digest, and the publisher. Signature verified first.

  3. 03input.validated

    The schema the arguments were checked against and the arguments digest.

  4. 04policy.allowed

    The deterministic decision reason and the exact scope that was required.

  5. 05credential.resolved

    The credential reference used for the upstream call. Never the value.

  6. 06dispatch.started

    Destination host, request fingerprint, and the timeout that applied.

  7. 07dispatch.completed

    Destination, HTTP status class, response bytes, and duration.

  8. 08output.validated

    The output schema, the output digest, and the fields that were redacted.

  9. 09response.delivered

    Effect none, outcome not applicable, and the output digest handed to the client.

If any step fails, its rejection event is written instead and nothing is dispatched: release.rejected, input.rejected, policy.denied, credential.rejected, dispatch.failed, or output.rejected. If the audit record itself cannot be written, the read does not happen.

Every successful call returns its evidencetools/call → result
{
  "output": { …the reviewed projection only… },
  "execution_id": "exec_9f2c41b8d07a3e5c6b1d02f4",
  "release_digest": "sha256:7c01e3…",
  "audit_tip": "e81f4a…"
}
  • execution_idFinds every event written for this call.
  • release_digestNames the signed bundle that controlled it.
  • audit_tipHash of the last event. Compare it with the stored chain.
How managed access works Read the trust model

Enforced boundary

The spec sheet, not the brochure.

Full trust model
Protocol
MCP 2026-07-28, stateless Streamable HTTP with JSON responses, at POST /mcp, with constrained 2025-11-25 handshake compatibility for verified clients.
Authentication
OAuth authorization code with PKCE S256 for interactive clients, plus separate expiring automation credentials. Only token digests and safe session metadata are stored.
Identity
Organization, principal, client, environment, and scopes are derived from the connected session or automation credential. No caller-supplied tenant selector exists.
Connected sessions
Exact client, member, environment, and tool consent; 15-minute access tokens; rotating refresh tokens; family revocation on replay; inventory and next-request revocation across replicas.
Release
Immutable canonical bundle containing one to 25 reviewed tools from no more than five exact source revisions, with a SHA-256 digest, HMAC-SHA-256 signature, publisher, and static-assessment snapshot. Verified before every request.
Source lifecycle
Immediate or fixed-interval discovery checks create immutable evidence and field-level semantic diffs without calling tools. Explicit acceptance is required before a reviewed revision changes; candidate evidence, atomic inactive publication, activation, and rollback remain separate.
Upstream authority
Anonymous, write-only shared bearer, or per-member OAuth is declared in each immutable tool contract. OAuth grants use authorization code and PKCE S256 and bind one member, named environment, and source. AES-256-GCM token ciphertext stays server-side; serialized refresh and disconnect are effective across replicas. Automation never receives member authority.
Discovery
tools/list returns only the tools the connected session or automation credential allows.
Authorization
Deterministic. The resolved organization must match the release, the tool must be present, and the caller must hold the exact required scope.
Destination
One reviewed public HTTPS endpoint per tool. Redirects, literal IPs, private resolutions, and caller-selected hosts are rejected.
Network
DNS resolution checks, non-public addresses rejected, no redirects, no proxy inheritance, TLS 1.2 minimum.
Limits
Release-defined timeout, a maximum 256 KiB upstream result, and a 1 MiB MCP request body.
Output
Output-schema validation and normalized structured content. The built-in read also applies an explicit projection and field redaction. Public errors never reflect submitted values.
Audit
Hash-linked events per execution in PostgreSQL. No raw payloads and no secret values.
Tenancy
Forced row-level security on tenant-owned tables. Published releases and source revisions are immutable.
Failure mode
Fails closed. If release verification, policy, validation, audit persistence, or a dispatch control cannot complete, nothing is sent upstream.

Every row describes the deployed enforcement boundary. Verified against the live endpoint on 2026-10-14.

Who it is for

Built for the people who have to say yes.

Technical owner

The developer, IT admin, or automation specialist who is asked to connect an assistant to the ERP, CRM, or helpdesk. You get a report you can act on and a boundary you do not have to build.

MSP or integrator

You support several small customers with similar systems. Assess their tool surfaces the same way every time, and give each organization its own credential, release, and audit chain.

Business owner

You need to know who used which tool, under what authority, and what came back. The evidence reads as a record of decisions, not a pile of infrastructure logs.

Managed access

From a public MCP source to an enforced endpoint.

  1. step 1 / 4

    Assess

    Run your current MCP tool surface through the free assessor. The findings become the review input for your release.

    free · no account
  2. step 2 / 4

    Authorize the organization

    We bind your verified identity to one organization, an administrator, operator, or viewer role, and either every environment or an exact selected set.

    identity-bound
  3. step 3 / 4

    Review the source

    Discover a public MCP endpoint, choose anonymous, shared-bearer, or per-member OAuth authority, inspect its immutable assessment and schemas, and compare later revisions before selecting explicitly read-only tools.

    operator-reviewed
  4. step 4 / 4

    Test, activate, connect

    Prove the candidate through the gateway, publish and activate its signed release, then authorize an interactive session or issue an automation credential. Rollback remains an explicit recorded activation.

    MCP 2026-07-28
Ready to put a real read behind the boundary?

Request an organization binding, then manage sources, connected sessions, automation credentials, and evidence in the console.

Request managed access

Questions

The boundaries, in plain terms.

What to understand before an assistant gets access to a business system.

Read the trust model
What is null.select?

Two things. A free risk assessor for MCP tool definitions, and a managed gateway that runs approved read-only tools behind one enforced, audited boundary. Use the first on any server. Use the second when an assistant needs real access to a business system and someone has to answer for it.

What does the assessor need from me?

Either one public HTTPS MCP endpoint with no credentials or parameters, or a tools/list response, its result object, or a plain array of tools. Endpoint mode performs one bounded metadata observation and never calls a tool. Do not submit credentials, prompts, tool responses, or customer data.

Do you store what I assess?

No. The assessor does not persist the endpoint URL or the submitted or observed definitions. The report identifier is a digest of the normalized tool document, so equivalent pasted and observed definitions produce the same identifier.

Is a clean report a safety certificate?

No. Static metadata cannot show how a server behaves, who may call it, or whether anything is recorded. Every report lists those controls as not observable, on purpose, so nobody mistakes silence for evidence.

What does the managed gateway run?

Explicitly reviewed read-only tools from public HTTPS MCP endpoints. Each tool contract declares anonymous, shared-bearer, or per-member OAuth authority. Personal OAuth grants are encrypted and bound to one member, environment, and source; automation cannot use them. Immediate or scheduled catalog checks add immutable evidence to a review queue without calling tools or changing runtime authority. An organization-wide operator explicitly accepts or dismisses observed changes, proves the selected tools through live structured-output tests, publishes one signed inactive release, and activates or rolls back separately. Each environment binds one immutable versioned profile for the complete reviewed boundary, public anonymous reads, or authenticated business-data reads; the same deterministic evaluator guards binding, activation, and dispatch. Reversible organization, source, environment, tool, principal, and credential stops apply on the next request and retain immutable operator history. The gateway does not execute writes.

How is the audit different from request logs?

A log says a request happened. The audit chain says which authenticated principal and client called which signed release, which immutable activation authorized it, why policy allowed it, what bounded destination was reached, what the validated output digest was, and what was returned. Operators can search exact execution facts with stable pagination, then verify the selected chain. Each event stores the hash of the previous one, and none of them store secrets or raw payloads.

How do I get managed access?

Request an organization identity binding. An authorized operator can then review a public MCP source, publish and activate its read-only release, authorize an interactive Codex or Claude Code session, issue separate automation credentials, and investigate the linked evidence from the console.

Is this only for enterprises?

No. It is built for small businesses, local organizations, and the integrators who support them: serious controls without a platform team. Pricing is per organization and is quoted after a short scoping conversation.

Start with evidence

Observe the endpoint or paste the tool list. See the gaps. Decide what deserves runtime trust.

The assessor is free and keeps nothing. The managed gateway turns the approved boundary into an enforced one.

Run the free assessment Request managed access

MCP 2026-07-28 nothing stored by the assessor separate publication and activation