Map the dependency surface
Identify the selected servers, capabilities, owners, and agent authority boundaries.
The MCP Release Gate Pilot gives a named engineering or security owner reproducible evidence, a CI policy, and a clear production decision for critical MCP servers.
We reply within one business day. Safe-mode by default; do not send secrets, production credentials, private URLs, or source code in the intake.
Identify the selected servers, capabilities, owners, and agent authority boundaries.
Generate startup, capability, schema, security, and drift evidence without destructive probes.
Deliver an approve, gate, or defer verdict, CI policy, SARIF handoff, and remediation order.
This is a sanitized example of the deliverable shape, not a customer case study or benchmark.
Selected servers, declared surfaces, ownership, and approved scope.
JSON, Markdown, SARIF, drift baseline, and a release-gate recommendation.
Decision summary, exclusions, remediation order, and next review date.
You have private, pre-production, or production MCP use and a platform, security, or engineering owner who needs to make a decision within 60 days.
Assess declared capabilities, schema and tool drift, safe-mode findings, and CI rollout readiness for selected servers.
No destructive exploitation, production writes, secret handling, certification, compliance attestation, or generic penetration test.
We use your high-level context to confirm fit and timing. Qualifying requests can book a 20-minute MCP Release Gate fit call immediately after submission.
A named decision owner, active pre-production or production use, and a decision within 60 days qualify for booking. Otherwise we will reply within one business day.
Qualified requests may book a 20-minute fit call. We confirm scope, owner, safe-mode boundary, and timing before requesting technical material.
The engineering owner, platform/security owner, and leader accountable for the production agent rollout.
The fixed pilot is $15,000, with 50% at signing and 50% before the final readout, subject to a written agreement.
Only if useful: separately scoped remediation support, recurring drift review, or an additional-server release decision.