MCP Policy Testing

What is it

MCP Policy Testing is the discipline of probing Model Context Protocol (MCP) servers and clients for policy bypass vulnerabilities — not just checking whether a tool is listed, but whether an attacker can reach tools the policy was supposed to block. The technical essence: MCP is the open standard (introduced by Anthropic in late 2024) that lets LLM agents call external tools, files, and APIs. Most security reviews today stop at the "tool list" — which tools are exposed, which are scoped. Policy testing goes deeper: can a malicious prompt trick the client into invoking a denied tool? Can a malicious MCP server hijack the agent's context and exfiltrate data? Can a WebMCP endpoint — the browser-side MCP bridge — be hijacked to make an agent act on a hostile page?

The business significance is that this is a new attack surface with no mature tooling. Tool-list scanners exist; policy-bypass testers and WebMCP attack labs do not. As MCP adoption grows, every company shipping an agent needs to prove its tool boundaries hold. That is a recurring compliance and QA need — the kind of thing that turns into a subscription, not a one-off pentest.

Why now

Three forces converge in late 2026. First, MCP has moved from a niche Anthropic proposal to a de facto standard: OpenAI, Google, and a long tail of SaaS vendors now ship MCP servers, and the spec has been revised repeatedly (the 2025-06-18 revision added OAuth-based authorization and resource indicators). More servers in production means more misconfigured policies.

Second, WebMCP — the browser-side bridge that lets web pages expose tools to agents — shifts the attack surface from server to browser. A hostile page can now present tools to an agent. That is a fundamentally new threat class, and the first public write-ups of WebMCP attack labs are appearing right now.

Third, the tooling gap is real. Existing MCP security tools (MCP-Scan by Invariant Labs, mcp-shield, various open-source linters) focus on tool poisoning and list hygiene. Nobody has productized policy testing — the adversarial side of "can this policy actually be enforced?" The timing is right because enterprises are just now moving MCP servers from pilot to production and their security teams are asking for evidence.

Market Evidence

The signal is thin but directional: 2 independent sources (devcommunity and Hacker News), 3 total mentions, a 100% growth rate, and stage classified as nascent, first seen 2026-11-06. Trend score 64/100. That is a legitimate early signal — HN is where security researchers drop proof-of-concept write-ups before they become products, and devcommunity posts tend to precede vendor tooling by months.

But be honest: 3 mentions is not demand. It is attention. The 100% growth rate is computed off a tiny base and should be read as "doubling from near-zero," not "exploding." The opportunity, market, demand, and competition scores are all 0/100, which in this scoring framework reflects insufficient data rather than a negative verdict — the model has nothing to score yet.

My position: this is a real emerging attack surface, but the market is not proven. The right read is "watch and validate cheaply," not "quit your job." The evidence supports building a free scanner to capture the search and community traffic while you test whether anyone pays. If you need proven demand before you start, wait one quarter — but you will likely be late.

Who's Behind It

The driving communities are MCP server maintainers, AI security researchers, and the red-team crowd that migrated from LLM prompt-injection research. On the vendor side, Invariant Labs (MCP-Scan) is the most visible name in MCP security tooling; other players include the maintainers of open-source scanners like mcp-shield and the OWASP-style working groups forming around agentic security. Anthropic itself controls the spec and therefore the threat model — its spec revisions (OAuth, resource indicators) are effectively the roadmap for what policy testing must cover.

The "whales" here are the platform owners: Anthropic, OpenAI, and the browser vendors (Google Chrome, Microsoft Edge) as WebMCP lands. If any of them ships built-in policy testing, the standalone market compresses fast. The indie opportunity is to be the vendor-neutral, cross-platform tester — the thing that checks every MCP server regardless of which model calls it. That neutrality is your moat against platform bundling.

TAM & Market Size

Buyers fall into three buckets. (1) Security teams at companies running MCP servers in production — realistically a few thousand organizations globally in 2026, growing fast. (2) MCP server vendors who need to prove their server is safe before customers will adopt — this is the sharpest pain, because a security questionnaire blocks a deal. (3) Consultancies and pentesters who need a repeatable policy-testing tool to bill against.

Price tolerance: security tooling budgets are real. A CI-integrated scanner is a $99–$499/month line item; a compliance report generator can justify $1,000+/month at mid-market. Pentest firms will pay per-seat for a tool that cuts their manual MCP testing time.

The honest caveat: all four market scores are 0/100, meaning there is no measured demand data yet. TAM is estimated top-down, not observed bottom-up. The bet is that MCP adoption follows the same curve as container adoption did — and that security tooling for containers (Snyk, Aqua, Prisma Cloud) became a multi-billion market. You are betting on the curve, not the current number.

Competitive Landscape

Current players are thin and mostly free. Invariant Labs' MCP-Scan is the reference tool: strong on tool poisoning and list hygiene, open-source, and backed by a credible research team. mcp-shield and similar projects cover static checks. General AppSec vendors (Snyk, Semgrep) have MCP-adjacent content but no dedicated policy-bypass engine.

The gap: nobody offers adversarial policy testing as a product — automated attempts to bypass a declared policy via prompt injection, tool-chaining, and WebMCP page hijacking, with a pass/fail report. That is the differentiation. Free scanners tell you what is exposed; policy testing tells you whether your controls actually hold under attack.

Big Tech risk is real but slow. Anthropic will likely ship spec-level guidance and maybe a reference checker; platform vendors will bundle basic scanning. You have an estimated 6–12 month window before bundling becomes a real threat, and bundling rarely covers cross-platform adversarial testing well. Compete on depth and vendor neutrality, not breadth.

Business Model

Recommendation: freemium SaaS with a CI/API tier, plus a paid compliance report add-on. Rationale: developers expect to try security scanners free; teams pay when it gates a release or a customer security review. The free tier (single server, manual scan) drives adoption and SEO; paid tiers monetize CI integration and reporting.

Suggested pricing:

• Free: 1 server, manual scans, community support.
• Pro — $149/month: 10 servers, CI integration (GitHub Actions), policy-bypass test suite, email alerts.
• Team — $499/month: unlimited servers, WebMCP attack lab, SSO, audit logs.
• Enterprise — from $1,500/month: compliance PDF reports, on-prem runner, SLA.

12-month forecast (conservative to optimistic): conservative 40 paying customers averaging $250/mo → ~$120K ARR; base 120 customers at $300/mo → ~$430K ARR; optimistic 300 customers at $350/mo → ~$1.26M ARR. CAC estimate: $200–$600 via content and community (HN, dev.to, MCP Discord servers); payback 2–4 months on Pro, under 2 months on Team. The economics work only if you keep support light and the scanner self-serve.

MVP Blueprint

Build in 5–7 days. Core only.

Day 1–2 — Scanner core. A CLI that connects to an MCP server (stdio and HTTP/SSE transports), enumerates tools, and compares against a declared policy file (YAML: allowed tools, allowed resources, scopes). Output: pass/fail per rule. Stack: Python (the MCP SDK is Python/TypeScript first) or TypeScript with the official SDK. Python is faster to ship.

Day 3–4 — Adversarial probes. Ship 10–15 canned attack probes: prompt-injection attempts to invoke denied tools, tool-chaining attempts, resource-scope escapes. Each probe returns pass/fail with a one-line explanation. Do not build a general fuzzer — canned, high-signal probes only.

Day 5 — WebMCP lab (minimal). A local HTML harness that exposes a fake tool via WebMCP and tests whether a client will invoke it. Ship as a demo, not a full product.

Day 6 — Report output. JSON + a clean HTML report. This is your sales artifact.

Day 7 — Landing page + waitlist. Deploy to Vercel, wire Stripe checkout for Pro.

Cut: dashboards, multi-user accounts, SSO, cloud-hosted scanning. Ship the CLI and the report. Suggested products: SaaS, CLI tool, API.

Commercial Opportunities

1. CI-gated policy scanner. Target: platform engineers at companies shipping MCP servers. A GitHub Action that fails the build if a policy-bypass probe succeeds. Expected $3K–$15K MRR within 9 months at $149–$499/mo. Beats alternatives because it slots into existing CI workflows with zero new dashboards.

2. Security-review report generator. Target: MCP server vendors facing enterprise security questionnaires. Generate a branded PDF proving policy testing was run and passed. Expected $5K–$20K MRR; vendors will pay because it unblocks deals. Beats generic scanners because it produces the artifact procurement actually asks for.

3. WebMCP attack lab for pentesters. Target: consultancies. A licensed lab environment with scripted WebMCP hijack scenarios. Expected $2K–$10K MRR at per-seat pricing. Beats building it in-house because consultancies bill hours, not tooling.

Product Ideas

🥇 PolicyProbe — "Prove your MCP policy actually holds under attack." CLI + CI integration that runs adversarial policy-bypass probes against any MCP server and fails the build on regressions. Target: platform and security engineers. Why now: tool-list scanners are commoditized; adversarial policy testing is not, and CI integration is the wedge.

🥈 MCP Trust Report — "The security artifact your procurement team asks for." A hosted service that runs the full probe suite and emits a branded, dated compliance PDF. Target: MCP server vendors. Why now: enterprise MCP adoption is gated on security reviews, and vendors need a cheap way to answer them.

🥉 WebMCP Lab — "Red-team the browser-side agent surface." A sandboxed lab with scripted hostile-page scenarios that test whether an agent invokes tools from untrusted pages. Target: pentesters and AI security researchers. Why now: WebMCP is the newest, least-tested surface, and first-mover content here earns disproportionate community attention.

SEO Opportunity

Search volume is nascent — "MCP security" and "MCP server security" are the head terms, with "MCP policy bypass," "WebMCP attack," "MCP prompt injection testing," and "MCP security scanner" as long-tail targets. Competition is effectively zero (SEO difficulty 0/100): no established content owns these terms. Strategy: publish the definitive technical write-up of each attack class with reproducible PoCs, then link the free scanner. Security researchers link to good PoCs; that is your backlink engine. Ship 2–3 deep posts per month and own the vocabulary before vendors do.

Risk Assessment

The thesis breaks if MCP policy testing turns out to be a feature, not a product — if Anthropic or a major platform ships a reference checker that covers 80% of the need, standalone demand collapses. Second risk: the attack surface matures faster than the market, meaning researchers publish everything openly and enterprises treat it as "solved by reading the blog." Third: execution risk — you build a scanner, but security buyers want a service, and you cannot sell services solo at scale.

Cheap validation: write one deep technical post on MCP policy bypass with a working PoC, post to HN and the MCP community, and measure. If it hits the front page and you get 20+ "can I run this on my server?" replies, build. If it gets 3 upvotes, walk away. Also run 10 customer-discovery calls with MCP server vendors asking how they currently answer security questionnaires. Walk away if nobody has been asked the question yet.

Action Plan

Today: Write the policy-bypass PoC — one script that connects to an MCP server and attempts to invoke a denied tool via prompt injection. Publish it with a clear write-up.

Week 1: Post to Hacker News and dev.to. Collect waitlist emails. Run 5 discovery calls with MCP server maintainers. Goal: 50 waitlist signups or 10 substantive replies.

Month 1: Ship the CLI MVP (scanner core + 10 probes + HTML report). Open-source the core, gate CI integration behind Stripe. Target first 5 paying customers at $149/mo.

Month 3: Ship WebMCP lab as a demo, publish the compliance-report generator, and hit $3K MRR. If MRR is under $1K at month 3 with no inbound, reassess — the market may be earlier than the signal suggested.

Related Terms

MCP Tool Poisoning — malicious tool descriptions that manipulate the agent; the adjacent attack class your policy probes must cover. WebMCP — the browser-side MCP bridge; the newest attack surface and the reason "policy testing" is expanding beyond server configs. Agentic AI Security — the umbrella category; positions your product inside a larger, better-funded budget line.