Correctover Blog
Practical security for production AI agents and MCP servers: audit checklists, threat deep-dives, output verification methodology, and the evidence enterprise buyers ask for.
MCP Server Security Audit Checklist (2026): An Attack-Surface Self-Assessment
Eight sections covering transport, credentials, SSRF, command execution, prompt injection, logging, and supply chain — each with what to check, plus free scanning commands to automate the baseline.
Why Schema Validation Is Not Enough for Agent Outputs
A schema validates the shape of JSON; it cannot see the intent of the values inside. How semantic intent checking catches command injection, SSRF, and credential leakage that well-formed output carries past every schema.
Command Injection in MCP Tools: How a Prompt Becomes a Shell Execution
A technical walkthrough of the chain from user prompt to shell: tainted arguments, argument-injection and indirect-exec variants, context-aware detection, and the argument-array fixes that close the sink.
What an Independent Agent Output Audit Covers (and How to Self-Check First)
The methodology of an agent output audit: seven CCS dimensions, 116 semantic intent rules grounded in disclosed MCP CVEs, severity rating — and the three free self-check steps to run before handing over a repo.
Shipping AI Agents to Enterprise: The Security Evidence Buyers Ask For
For startup CTOs: the six evidence categories enterprise security reviewers expect, a question-to-artifact map for the questionnaire, and how to assemble the pack before the first RFP or fundraise diligence.
22 Microseconds: Real-time RCE Detection Benchmarking for AI Workloads
A technical deep-dive into latency benchmarking methodology for runtime attack interception, and why sub-100-microsecond detection matters in production AI.
From Bounty to Defense: How 7 RCE Disclosures Shaped Our Detection Rules
Seven responsible disclosures across agent frameworks — and the common pattern behind them: lack of runtime input validation. How each became a detection rule.
CCS Compliance for AI Systems: A Rule Framework for Production Security
Why traditional security frameworks leave blind spots in AI-specific attack surfaces, and how detection rules map to automated compliance verification.
The AI Runtime Attack Surface: Threats Every CISO Should Know
From RCE via MCP tools to supply chain tampering and pipeline drift — the runtime threats facing enterprises deploying AI, with a pragmatic defense approach.