Gated
The audit layer for MCP servers

The MCP servers that matter most are the ones nobody can scan.

They're behind your VPN, on a workstation, in a private subnet. Gated audits those — the same way it audits the public ones.

Free first audit. No credit card.

Audit targetspublic + private
mcp.acme.com
Public endpoint
Audited
mcp.internal.acme
Private · behind the VPN
Audited
localhost:8131
Private · on a workstation
Audited
10.0.2.7:9000
Private · in a subnet
Audited
01 / how private scans work

The CLI is a pipe, not a brain.

For a server behind your firewall, you run the gated CLI from inside your network. It dials out and forwards traffic — our scanner drives every probe, and the check logic never leaves our side.

02 / why now

MCP servers ship faster than anyone audits them. A server goes from prototype to mounted-in-production in an afternoon — the review that would catch a leaking tool or a malformed error envelope never happens.

The agent on the other end is an untrusted component with broad tool access. It will call what it is offered. Every tool, resource, and prompt a server exposes is reachable surface, and most of it was never read by a human.

That surface also has a running cost. It is loaded at initialize, counted against the context window every session, and measured by no one. Shipping the server is the cheap part. Everything it quietly does afterward is not.

03 / what gated does

Gated points two engines at a server and merges what they find into one ranked report — with a reproduction for every finding.

01 The catalog

228 deterministic checks

Across security, conformance, quality, reliability, and cost. Each maps to one family and one severity, runs at a chosen intensity, and is identical on every run — the baseline you can put in CI.

02 The arena

An adversarial LLM

An agent that actively tries to break the server — not only to get in, but to surface flaws across all five families. It improvises the attacks a fixed checklist can't, then files them the same way.

See the adversarial phase
04 / coverage

Five families. 228 checks.

Every check belongs to one family and runs from a declared intensity upward. How the catalog spreads across the two axes:

FamilypassiveprobeexploreTotaladversarial
Security24442088
LLM-driven phase

Where the checklist ends, the model begins. It reasons about your target, forms attack hypotheses, and probes them live — surfacing the flaws a fixed catalog never could.

Conformance3440983
Quality241126
Reliability93618
Cost111113
All families929937228explainer
Counts grow as the catalog does.Browse the full catalog
05 / intensity

You choose how hard it looks.

Four strictly-ordered levels — each a superset of the one above it, so Explore runs Passive and Probe too. What the server says about itself, then whether it does what it says, then what happens when you use the whole surface for real, then what a determined attacker can extract.

Passive

Validates everything the server says about itself — serverInfo, declared capabilities, and the full schemas of every tool, resource, and prompt — without ever making a real tool call. The “lint” intensity: safe on production at any time, safe in CI on every PR.

Probe

Starts touching the target, but only safely. Loads resources, calls non-destructive tools, and forces validation failures — negative numbers, out-of-range values, malformed inputs — to see how the server defends its boundaries. No destructive tool is ever called.

Explore

Goes all in on legitimate use. Calls every tool with LLM-generated arguments, walks pagination chains, bursts calls to probe rate-limit behavior, and opens many concurrent connections. Best on staging, or production with explicit opt-in.

Adversarial

An LLM-driven attack — prompt injection, tool poisoning, and sustained multi-step exploitation chains, equivalent to a senior tester actively trying to break the server. Requires explicit opt-in per scan.

06 / how the adversarial phase works

Three agents, one bounded cage.

At adversarial intensity the work splits across three agents inside one harness. One forms theories from a library of tactics, a second probes the target for each, and a third keeps only what it can prove — every move rate-limited, scoped to a target you own, and on the record.

live / demo scan

See a real report before you sign up.

A complete scan of a sample MCP server — the same report you get for your own servers. Browse the ranked findings, the discovered tool surface, and every tool call the scan made. No account required.

Open the demo report
Pricing

Four tiers. One catalog.
Pick the depth you need.

FreeSolo dev
$0forever
  • Up to 3 targets
  • 1 team member (solo workspace)
  • 200 scans / month (any intensity)
  • 300 inspections / month — hard stop, no overage
  • All four intensities, including adversarial
  • 30-day scan history
  • HTML & PDF reports
ProSmall eng team
$99+ / month
  • Everything in Free
  • Up to 25 targets
  • Up to 10 team members
  • 1,000 scans / month (any intensity)
  • 1,000 inspections / month
  • See finding reproduction steps
  • 1-year scan history
  • SSO
TeamSecurity team
$599/ month
  • Everything in Pro
  • Up to 100 targets
  • Up to 20 team members
  • 5,000 scans / month (any intensity)
  • 5,000 inspections / month
  • Per-scan inspection cap (default 200)
  • 2-year scan history SLA
EnterpriseRegulated enterprise
Let's talk
  • Everything in Team
  • Unlimited team members, targets, scans
  • Negotiated inspection bundle (50k–500k / mo)
Annual billing · 20% off·No per-finding fees·Transparent inspection metering·Cancel anytime
FAQ

Straight answers. No fine print.

Missing a question? Email hello@gated.cc — we'd rather answer it directly.

Gated runs five families of checks against every MCP server you point it at. Security — Can the server be coerced into doing something it shouldn't? Auth gaps, injection surfaces, token leaks, tools exposed without scope. Conformance — Does the server follow the specs it claims to? MCP, OAuth, JSON-RPC, HTTP, TLS — all the contracts a stable building block depends on. Quality — Is it pleasant to integrate against? Schema correctness, error shape, descriptive metadata, predictable tool behavior. Reliability — Does it stay correct under load and partial failure? Timeouts, retries, idempotency, cancellation, behavior at the edges. Cost — Will it bankrupt the team that adopts it? Payload bloat, chatty tools, unbounded responses, expensive defaults.
07 / get started

Point Gated at a server.

Public or private, your first audit is free — a ranked report with a reproduction for every finding, in minutes.

Free first audit. No credit card.