MCP stack permission report
The audit report, generated for your own MCP stack or your own server — in your browser, in seconds, with no one to wait for. Hand it to a security reviewer, a customer's questionnaire, or your own team.
One report for your whole stack
Built by the same engine that scores the index, from each server's published manifest.
- A cover sheet with a single stack exposure score and every server side by side
- Your stack blast radius: where outside content comes in, and what it could reach
- A full audit sheet per server: findings by severity and the limits to put on each tool
- Those limits, enforceable with one command —
npx @leashkit/guard tighten <server> - Or paste your own server's
tools/listfor a report on just that server - A dated, self-contained HTML file you can print to PDF and share
Regenerate as often as you like for 30 days Buy the report → $49 is the whole amount: any tax is already in it. Checkout is run by Link, by Stripe, so that is the name on your statement. Your config is never sent — only the payment travels.
Paste a config or open a file to see what the report will cover. The preview is free.
Which one do you need?
Stack check
FreeScores and blast radius on screen. Good for deciding what to connect.
Stack report
$49The same analysis as a dated document with findings and recommended limits per server — for anyone you have to show it to.
Pre-publish check
$29For maintainers: how your next release will read in the index before you ship it.
Good to know
Is my config uploaded?
No. The report is built on this page, which cannot make network requests. When you buy, your browser goes to Link's checkout and back; only the payment travels. The config is never part of it.
What if a server in my config is not in the index?
The report lists it as not reviewed and says why. The preview shows exactly which servers will be covered before you pay. For a server outside the index that you maintain, paste its tools/list here for a report on that server, or submit it to have it listed.
Who am I buying from?
Link, by Stripe is the merchant of record: Stripe takes the payment, handles the tax and sends your receipt, and your statement will say sold through Link. The report itself comes from us. Terms.
Can I get a refund?
Yes. If the report does not generate or does not cover what the preview showed, ask within 14 days from the receipt Link sent you when you paid. How to ask. Buying from the UK or EU? Your statutory rights are set out under consumer rights.
Why is it $49?
It is a launch price while the index builds its reputation, and it may go up. A report you have already bought is yours at the price you paid.
Can I apply the limits the report recommends?
Yes, and without retyping them. Leash Guard is a free MIT proxy that sits in front of an MCP server and enforces a limit per action; npx @leashkit/guard tighten <server> applies the same numbers this report prints, because both come from the same audit engine. Nothing in the report requires it.
Does buying change any listing?
No. Buying a report or an audit never changes a listing, a score or a ranking.