Break the payment flow before an attacker does.
TrustGate is an independent dynamic security audit for MCP and agent-commerce systems. We test authorization binding, replay resistance, idempotency and fail-closed behavior against a target you own or are explicitly authorized to test.
Designed for early MCP/payment-agent builders who want a fast, reproducible security check before broader launch.
Want to confirm your target is within scope before paying? Email us for a free pre-purchase scope check. No credentials or production access needed for this enquiry.
Replay resistanceIdempotencyAuthorization bindingFail-closed behaviorWhat you get
- Dynamic adversarial testing of one MCP or agent-commerce target.
- Checks for replay, stale or changed transaction context, and authorization-ID reuse.
- Deterministic PASS / FAIL_CLOSED findings with reproduction notes.
- A concise report describing observed failures and their security impact.
Preview the audit report format (illustrative, not a customer assessment).
Current evidence
TrustGate v0.5 currently passes 30/30 local unit and integration tests. Its safe reference MCP target passes 15/15 scanner cases, while intentionally vulnerable replay and idempotency fixtures are rejected FAIL_CLOSED on the expected controls.
These results describe our test harness, not a guarantee that any customer system is vulnerability-free.
Who this is for
Teams building MCP servers, AI-agent purchasing flows, payment agents, or agentic-commerce authorization layers.
Authorization required: we test only systems you own or have explicit permission to assess.
Delivery & refunds
After purchase, we contact you to collect the target details and proof of authorization. Delivery is normally a concise findings report plus reproduction notes for the agreed target.
If we cannot accept the target before testing begins, the order is refunded. Once an authorized audit has started, refunds are handled case by case based on work already performed.
Contact
TrustGate is an independent security-testing service operated by Tomasz Czuba in Poland.
Email: czuba92@gmail.com