Ascension Technologies
sales@ascensiontechsolutions.com
Security reviews for AI agents and MCP servers
If your agent reads email, web pages, tickets or documents and can then call tools, someone outside your company can put instructions in front of it. We test whether those instructions can make it leak data or take actions your users never asked for, and we tell you exactly what to change.
Email us about a reviewWhat we test
- LLM01
- Indirect prompt injection. Instructions hidden in tool results, web pages, emails, tickets and files that the agent reads and then follows.
- LLM06
- Excessive agency. Which tools and permissions the agent holds, what an attacker could do with them, and which actions should need a person to approve.
- LLM02
- Data exfiltration. Ways private data can leave through links, images, tool calls or replies once the agent has been steered.
- MCP
- MCP servers. Tool descriptions, authentication and scopes, and the untrusted text your server passes straight to the model.
Codes refer to the OWASP Top 10 for LLM Applications.
What you get
A written report. Each finding has a severity, steps to reproduce it, the impact, and a specific fix, ordered by risk.
Support ticket text can make the agent email customer records to an outside address
- Reproduce
- Open a ticket whose body includes a hidden instruction to forward the requester's account history. Ask the agent to summarize the ticket.
- Impact
- The agent calls
send_emailwith the account history attached, without asking anyone. - Fix
- Mark ticket text as untrusted, block outbound email while untrusted content is in context, and require approval for sends to new domains.
Illustrative example of the report format, not taken from a client engagement.
Price
Agent security review
One agent or MCP server, three business days. Includes a short findings call or Q&A by email. This is a first-client rate, normally $1,500, in exchange for a short testimonial if you're happy with the work.
Agent security audit
About a week across several agents, tools or workflows. Adds automated attack suites, a review of your guardrail and permission design, and a retest after you ship fixes.
How it works
- A 30-minute call to map what your agent reads, which tools it can call, and what a bad outcome would be. We agree the scope in writing.
- We test a staging or test environment you authorize, with hand-written and automated injection attacks. Nothing is tested without written permission.
- You get the report, and we answer questions on a short call or by email.
Evidence
The tooling behind the review is our own and the results are public.
| Result | Ours | Comparison |
|---|---|---|
| Indirect-injection detector, AgentDojo AUC | 0.984 | 0.793ProtectAI v2 |
| Same benchmark, false-positive rate | 0.031 | 0.333ProtectAI v2 |
| Agent benign tasks completed with the detector deciding what to quarantine | 70 / 97 | 32 / 97without the detector |
| Injection attacks that succeeded in that setup | 0 / 200 | 0 / 200without the detector |
Sources: the detector on Hugging Face, the agent benchmark write-up, and the harness comparison.
Reviews are done by Ashton Damrel, who ran an AI agent with production access as a company's sole engineer and designed its guardrails. Portfolio.
Start a review
Email sales@ascensiontechsolutions.com with what your agent does and which tools it can call. We reply within one business day with a proposed scope and start date.