MCP Server Security Audit

The same pipeline that found CVE-2026-106763, CVE-2026-106764, CVE-2026-106765, run against your MCP server.

We review a published or private MCP server for the vulnerability classes that actually reach an operator through tool arguments — command injection, SQL injection, and path traversal — tracing each candidate from its tool-schema definition to the sink, and we hand back a CVE-grade report: confirmed findings with source traces, a severity rating, and a one-line remediation each.

proof 3 MITRE-assigned CVEs credited to Still OS Digital Holdings LLC, each independently verifiable from the affected package's own source.

method static taint analysis (CodeQL) + source review + a safe, nonce-verified reproduction, held privately under coordinated disclosure.

not a scanner dump. Only findings traced to a real tool-argument-reachable sink are reported; false positives are screened out before you see them.

Registry, host, or vendor shipping MCP servers, or a team that wants its own server audited before it ships — request a scope. Still OS Digital Holdings LLC · security@stillosdigitalholdings.com.