AI AGENTS · MCP TOOLS · CONNECTED DATA
AI agents can read documents, call tools and change systems. Safematix tests whether untrusted instructions, excessive permissions or connected services can cause unintended actions or expose data. You receive reproducible evidence, prioritized fixes and a focused retest—not just a model score.
01 / BUYER FIT
This service is for teams making decisions about an agent’s access, actions or deployment. The starting point depends on whether you already have a system to assess or need a controlled pilot for one workflow.
01
Your agent will search company documents or answer questions from internal data. Safematix examines which information can enter its context, who may retrieve it and whether malicious content can redirect the agent or expose information beyond the intended audience.
02
Your agent can call APIs, update records or use operational tools. The assessment examines permissions, approval boundaries and combinations of actions, so your team can distinguish necessary access from access that creates an avoidable attack path.
03
You need control over model traffic, documents or deployment infrastructure. Safematix reviews the agreed data paths and surrounding controls; running a model locally does not by itself prevent unsafe tool calls, excessive access or external data transfers.
04
You have a workflow worth exploring, but not enough evidence to justify wider automation. The separate Value Sprint establishes a baseline, builds an evaluated pilot and documents operating assumptions, limitations and the decisions required before a broader rollout.
02 / CAPABILITIES
Testing is limited to the agreed agent, integrations and environment. Safematix examines how model behavior interacts with permissions, retrieved information and executable tools—not just whether a model refuses a particular prompt.
01
Safematix tests whether instructions in user input, retrieved documents or tool responses can redirect the agent. Findings connect the triggering input to an observable result, such as an unauthorized tool request, information disclosure or a bypassed approval step.
02
Model Context Protocol connects agents with tools and data. Safematix examines tool descriptions, inputs, access rights and chained calls to determine whether an agent can exceed its intended authority or combine individually permitted actions into an unintended result.
03
Safematix examines how documents are selected, permissions are applied and information reaches the model. For agreed local-inference work, the review includes relevant serving and data-flow controls, making clear which components remain local and which still depend on external services.
04
An assessment recommends control changes and verifies client-supplied fixes. The separate Value Sprint builds a pilot for one workflow, with evaluations, audit controls and operating guidance. Implementation, model training and ongoing operations are not silently included in an assessment.
03 / DELIVERABLES
The security assessment produces the five artifacts below. The Value Sprint has a different deliverable set: a workflow baseline, target architecture, evaluated pilot, operating guide and handover, within its stated package limits.
01
A written record of the assessed agent, tools, data sources, identities and important trust boundaries. It also identifies exclusions and access assumptions, so readers can understand what the assessment covers and avoid treating an untested component as approved.
02
Each finding records the relevant preconditions, input, tool interaction and observed behavior. Evidence explains how the result was reached without unnecessarily exposing secrets, allowing your team to reproduce the issue and distinguish demonstrated impact from a hypothetical possibility.
03
A report connects technical behavior to potential business impact, root cause and a practical remediation direction. Priorities account for the tested conditions, while limitations and remaining questions are recorded rather than hidden behind a single score.
04
Safematix walks your team through the findings and proposed controls. The workshop clarifies what should change and how the change will be checked; your team retains responsibility for implementing fixes unless implementation has been separately agreed.
05
The assessment includes one focused retest within 30 days of the initial debrief, using your remediated build or configuration. Results distinguish fixed, partially fixed and open findings, with updated evidence and remaining exposure rather than a blanket safety statement.
04 / EXPERIENCE
Robert’s public MCP projects and model artifacts make specific technical work visible. They support a discussion about approach and engineering depth without relying on undisclosed customer names or unverified outcome claims.
Robert’s public mcp-firewall project publishes policy and audit-control code between an agent and an MCP server. It provides inspectable examples of tool-call checks and recorded decisions, rather than claiming that adding a gateway automatically makes every deployment safe.
Inspect mcp-firewallThe public mcpwn project documents checks for issues including tool poisoning, prompt injection, excessive permissions and data exposure. Its distinction between safe inspection and authorized active probes makes the intended test behavior and operating limits available for review.
Inspect mcpwnRobert publishes model-engineering work covering behavior changes, quantization and deployable formats. These artifacts show hands-on work beyond writing prompts, with stated evaluation limits rather than a general promise of reliable or secure behavior across every model and environment.
View published models05 / Approach
The engagement starts with written scope and authorization. Assessment and pilot work follow different deliverables, but both make access requirements, checkpoints, evidence and client responsibilities explicit.
Safematix clarifies the workflow, agent access, data boundaries and decision you need to make. Together we distinguish an assessment from a pilot engagement, agree the package limits and document authorization, evidence handling, escalation contacts and stop conditions before technical work starts.
Your responsibility Identify the system owner and technical contact, approve the scope and provide agreed documentation, test accounts and suitable sample data through the secure channel.
For an assessment, Safematix tests the agreed attack paths across the agent and its integrations, validating results before treating them as findings. For a Value Sprint, work starts from the workflow baseline and produces the agreed pilot, evaluations and controls.
Your responsibility Maintain agreed access, answer technical questions and flag operational or data-handling constraints before they affect the work.
Safematix explains findings, control options and limitations in technical and business terms. Assessment work includes the report and remediation workshop; pilot work compares the implementation with agreed evaluation criteria and operating assumptions, without inventing savings or promising a production outcome.
Your responsibility Involve the people who can assess business impact, implement changes and decide which risks or operating assumptions are acceptable.
The assessment’s focused retest checks your remediated build or configuration within 30 days of the initial debrief. The Value Sprint concludes with operating guidance, evaluation results and prioritized next steps. Broader testing, production expansion and ongoing operations require a separate agreement.
Your responsibility Implement assessment fixes and supply the updated system for retesting, or confirm ownership and the next decision for the pilot.
06 / PACKAGES
The AI Agent & MCP Security Assessment is CHF 14’800 for 8 working days: one agent with up to five MCP tools or integrations. The Secure AI Agent Value Sprint is CHF 24’800 for 12 working days: one workflow with up to three integrations. These are different engagements; scope, authorization and start date are confirmed in writing.
AGENT & TOOL-CHAIN DEFENSE
CHF 14’800
8 working days
Attack one agent and its tool chain, then help harden the controls that contain real attack paths.
AUTOMATION WITH CONTROL
CHF 24’800
12 working days
Turn one costly workflow into a secure, evaluated agent pilot—with controls and measurable operating assumptions, not automation theatre.
Flexible engagements: CHF 2’200 per working day. Longer, clearly scoped remote projects: CHF 2’000–2’100. Short-notice OT, red-team, and high-security engagements: CHF 2’400–2’600, subject to scope.
All package prices and day rates exclude applicable VAT and pre-approved travel and third-party costs, unless expressly included in the order form. Fixed-price packages apply within their stated scope. Scope, authorization, and start date are confirmed in writing before work begins. Regulatory mapping is technical, not legal advice. Savings and compliance outcomes are not guaranteed.
07 / FAQ
MCP, or Model Context Protocol, connects an agent with tools and data sources. A model’s answer is only one part of the system: tool permissions, retrieved documents, approvals and connected services can change the result. Safematix tests the agreed components and their interactions; the package does not automatically cover every surrounding system.
The AI Agent & MCP Security Assessment (CHF 14’800, 8 working days) evaluates one existing agent with up to five MCP tools or integrations. The Secure AI Agent Value Sprint (CHF 24’800, 12 working days) builds and evaluates a pilot for one workflow with up to three integrations. Choose according to whether you need security evidence or a workflow pilot.
Local inference can be designed around your data and deployment requirements. Before work begins, Safematix agrees which models, tools and services may process information, and records any remaining external data paths. Local hosting is not itself a security guarantee: retrieval permissions, tool access, logging and outbound connections still need to be considered.
Safematix needs written owner authorization, a technical contact, a description of the agent and integrations, and the agreed test access or sample workflow. Suitable test data and an architecture overview help establish meaningful boundaries. Credentials, confidential documents and sensitive exploit details should be exchanged only through the agreed secure channel, not the initial enquiry form.
The assessment includes recommendations, a remediation workshop and one focused retest within 30 days of the initial debrief. Your team provides the remediated build or configuration. Remediation development, additional agents or tools, production model training and additional retests are not included in that package; any additional implementation is scoped separately.
No. It provides evidence about the agreed system, conditions and test period, with documented coverage and limitations. New integrations, permissions, models or data can change the risk. Technical control mapping is not a formal compliance certification or legal opinion, and neither an assessment nor a pilot guarantees security, savings or compliance outcomes.
08 / Contact
Tell us what the agent is meant to do, which tools or data it can reach and which decision you need to make. A general description is enough for the first enquiry. Do not send credentials, confidential documents or sensitive exploit details.
Discuss your agent and its access