Dedicated AI Agent security audit for financial institutions. We scan MCP-based agent frameworks (AutoGen, Dify, FastMCP, Semantic Kernel) for protocol-level, supply-chain vulnerabilities that automated scanners miss. Findings filed with HackerOne, ZDI, and GitHub Security — each one verified and reproducible.
Thanks — we’ll reply within 24 hours to with your snapshot audit window.
Sources: 24 CCS rules = ccs_scanner.py VULN_PATTERNS · 87 readOnlyHint bypass instances across 6 frameworks = CCS Deep Scanner v4.2 (2026-07-21) · Active report = HackerOne #3878033 · 80K API traces = 20K public (Correctover/standards release ccs-v1.0) + 60K reserve.
Anyone can run a scanner. The hard part is a verifiable runtime verdict you can hand to a regulator — and that is exactly what the Correctover CCS verification layer is standardized around.
Our independent IETF draft (draft-02, posted #167528) defines an Agent runtime verification layer: fail-closed adjudication + signed receipt. It does not flag — it decides, and the verdict is cryptographically attributable. No other agent-security audit product operates on this basis.
Our 7-dimension verification framework is referenced independently in three places inside the IETF working group (Iman, Bradley, Sumit). The framework that audits your stack is the one the standards body itself builds on.
P50 <10µs, P99 <25µs at 50K requests — measured, not promised. The verification layer sits inline in production traffic without becoming the bottleneck your SRE team calls you about.
Our verification layer passes the Emilia Protocol independent validation, confirmed by Iman Schrock. Third-party validated — not self-asserted.
Positioned for the IETF AUDIT BOF direction: audit records as a trusted data source. When the ecosystem converges on audit-record standards, Correctover's audit output is already shaped to be the input.
Traditional DAST/SAST scanners flag possible issues; they can't assert a runtime verdict on agent delegation. The audit delivers what regulators and buyers actually need: a deterministic, attributable, reproducible verification result — with the IETF standing to back it.
Your existing DAST/SAST scanners don't understand MCP protocol semantics. They look for SQLi and XSS. We look for protocol-level failures that traditional tools miss.
Every major MCP framework (AutoGen, FastMCP, Semantic Kernel, Griptape, Dify, LangChain) defines a readOnlyHint flag — but none actually check it before executing destructive operations. Protocol-level design flaw affecting multiple code locations.
This is a supply-chain vulnerability: the flaw originates in the official SDK and propagates to every downstream consumer.
Both Microsoft AutoGen (magentic-one-cli) and Dify (Apollo config) pass user-controlled file paths directly to open() — CVSS 9.8. Submitted to the ZDI disclosure channel.
No authentication bypass needed — attacker-controlled --config flag reads arbitrary files.
FastMCP and MCP Python SDK CLI pass os.environ to subprocesses verbatim. API keys, database credentials, and cloud provider secrets are exposed to every spawned process.
Not an isolated bug — a systemic pattern. The same readOnlyHint bypass appears 87 times across AutoGen, Semantic Kernel, FastMCP, Griptape, Dify, and the MCP SDK itself.
All vulnerabilities below were verified in production code and submitted to the appropriate disclosure channels.
| ID | Type | Target | CVSS | Status |
|---|---|---|---|---|
| P1-PATH | Path Traversal | AutoGen magentic-one-cli | 9.8 | MSRC Submitted |
| AGT-TOOL-NO-READONLY | Protocol Bypass | Semantic Kernel | 7.5 | MSRC Submitted |
| AGT-TOOL-NO-READONLY | Protocol Bypass | MCP Python SDK | 7.5 | H1 #3878033 Active |
| AGT-TOOL-NO-READONLY | Protocol Bypass | FastMCP, Griptape, Dify | 7.5 | ZDI Submitted |
| P1-PATH | Path Traversal | Dify Apollo Config | 9.8 | ZDI Submitted |
| AGT-ENV-LEAK | Credential Leak | FastMCP + MCP SDK | 7.0 | ZDI Submitted |
Banks and fintechs are adopting AI agents faster than any other vertical — but their security models haven't caught up.
Financial institutions are moving decisioning, reconciliation, and trade-execution workloads onto MCP-based AI agents. A protocol-level flaw in that layer — such as the readOnlyHint bypass — is directly exploitable in financial operations.
Your bank may not directly use a vulnerable framework — but your vendors do. Duco serves 7 of the top 20 banks. Mambu's Intelligent Core connects to every major bank's core systems via MCP.
EU AI Act, DORA, SOX, PCI DSS, and national financial regulators all require AI governance. A protocol-level bypass in your agent infrastructure means your compliance assertions may be invalid.
readOnlyHint bypass means an agent performing loan origination, trade execution, or compliance checks can be tricked into performing destructive operations — even when the client explicitly marks the call as read-only.
If your stack includes any of these, you have known protocol-level vulnerabilities that need immediate attention.
Vulnerable: P1-PATH (CVSS 9.8) + AGT-TOOL-NO-READONLY (CVSS 7.5)
Risk: Path traversal via --config flag; readOnlyHint never enforced
Vulnerable: P1-PATH (CVSS 9.8) + AGT-TOOL-NO-READONLY (CVSS 7.5)
Risk: Config file path traversal; protocol bypass
Vulnerable: AGT-TOOL-NO-READONLY (CVSS 7.5) + AGT-ENV-LEAK (CVSS 7.0)
Risk: 25 verified readOnlyHint bypass locations; full env leaked to subprocesses
Impact: Bypass inherited from the MCP Python SDK — carries into every FastMCP deployment
Vulnerable: AGT-TOOL-NO-READONLY (CVSS 7.5) + AGT-ENV-LEAK (CVSS 7.0)
Risk: 43 verified readOnlyHint bypass locations — root cause of the supply-chain issue
Impact: All downstream frameworks inherit this vulnerability
No source code required. No disruption to production. We work from your deployment config and framework version.
You share which frameworks and versions you use. We cross-reference against our CCS rule database (24 rules) and known readOnlyHint bypass instances (87 across 6 frameworks). 48-hour report.
If the snapshot finds issues, we run a full CCS deep scan on your deployment: protocol-level analysis, dependency chain tracing, and supply-chain impact assessment.
Written report with prioritized fix roadmap, code-level patch suggestions, and a retest schedule. Includes a 1-hour CISO brief with our findings and recommendations.
Transparent, outcome-based. Start with a free snapshot to understand your exposure.
Framework version check against 24 CCS rules. Written summary with top risk findings.
Full CCS deep scan, supply-chain dependency analysis, and CISO-ready report with fix roadmap.
Continuous monitoring, priority vulnerability response, and quarterly deep scans for enterprise teams.
No. We work from framework version identifiers and deployment configuration. Our CCS scanner correlates framework versions against known vulnerability patterns — no source code required.
No. The Free Snapshot is entirely passive — we never connect to your infrastructure. The Deep Audit uses opt-in read-only probes that we agree on beforehand. No production disruption.
We tell you honestly. The Free Snapshot is always free, regardless of outcome. For the Deep Audit, if we find zero actionable findings, you pay nothing for the scan portion — only the report delivery ($500 flat).
Standard pentests look for SQL injection, XSS, and misconfigurations. They don't understand MCP protocol semantics. Our CCS scanner is purpose-built for AI agent frameworks — it checks for readOnlyHint bypasses, protocol-level authorization gaps, and framework-specific path traversal patterns that no DAST/SAST tool catches.
No. All findings are confidential to your organization. We do not disclose without your written consent. Our bounty submissions (MSRC, ZDI, H1) were for different vulnerabilities in open-source frameworks, not for any client engagement.
Yes. Standard NDA can be executed before any information sharing. We routinely work with financial institutions under NDA.
We found a protocol-level bypass (readOnlyHint) appearing 87 times across 6 frameworks. One of them is in your stack.
Free snapshot audit — 48 hours, no commitment, no code access needed.