Vouchsafe — MCP-server trust seal for indie AI-tool builders

1. One-liner

Turns your MCP server into a signed, enterprise-ready security report and badge that clears the buyer’s allowlist.

2. Trend signal — why now?

MCP went from a niche Anthropic spec to the default way agents plug into tools — and then the security bill came due, all in the last ~12 months.

• Supply exploded. MCP.so indexes 20,222 servers (Apr 2026); LobeHub lists 56,000+; the official Anthropic/GitHub/Microsoft registry has 8,400+ verified servers (May 2026); GitHub returns 15,926 repos tagged mcp-server. The SDKs hit 97M monthly downloads. This is a real developer population, not a hype chart.
• Security became the #1 adoption blocker. Surveys in 2026 found 50% of MCP builders name security/access control as their top challenge and 38% say security concerns are actively blocking increased adoption. The buying pain isn’t “help me scan” — it’s “the deal is stuck because the customer won’t approve my server.”
• The attacks are named and public. MCPTox tested 45 live servers / 353 tools and saw tool-poisoning attack-success rates above 60% (highest 72%). Trend Micro found 492 MCP servers exposed to the internet with zero authentication; 1,862 publicly reachable instances answering unauthenticated requests as of May 2026. OX Security’s May 2026 “mother of all AI supply chains” disclosure and the June 2026 “agentjacking” class made “is this MCP server safe?” a board-level question.
• Enterprises now gate installs. MintMCP, Obot, Cloudflare’s enterprise-MCP reference architecture, and Claude Code’s managed-MCP allowlist all assume a security review before a third-party server is approved. GitHub has open community threads begging for org-level MCP allow/deny lists. The reviewer exists; the artifact the builder hands them does not.

The convergence: huge, fast-growing builder population + a hard adoption gate + no standard “prove it’s safe” artifact for the small builder.

Provenance:

• Signal 1 (demand): 50% of MCP builders cite security as #1 challenge, 38% say it blocks adoption; “DevSecOps… unceremoniously block the deployment” — https://www.digitalapplied.com/blog/mcp-adoption-statistics-2026-model-context-protocol , https://leandrocaladoferreira.medium.com/why-your-new-mcp-server-just-failed-the-enterprise-security-audit-and-how-to-fix-it-26d27b099190 — 2026-05-14
• Signal 2 (feasibility): Commodity static scanners (Cisco mcp-scanner, Snyk agent-scan, MCPTox, MindGuard) + OAuth 2.1 MCP spec exist off-the-shelf; a trust report can be assembled on top — https://www.practical-devsecops.com/mcp-security-vulnerabilities/ , https://pipelab.org/blog/state-of-mcp-security-2026/ — 2026-06
• Signal 3 (economic): Enterprises run allowlists + SAST gates (MintMCP/Obot/Cloudflare); SOC 2 trust-badge add-ons already sell at $3–8K/yr proving willingness to pay for a trust artifact — https://www.mintmcp.com/blog/mcp-server-security-vetting , https://soc2auditors.org/insights/vanta-pricing/ — 2026 Category: Tech-unlock

3. The opportunity

There are two commodity extremes and a gap in the middle.

• Free scanners (Cisco, Snyk, MCPTox, MindGuard) tell a builder what’s wrong on their own machine. Output: a terminal dump. Nobody outside the builder ever sees it, and it proves nothing to a buyer.
• Enterprise gateways (MintMCP, Obot, Cloudflare) vet servers on behalf of the adopting company — buyer-side governance, sold to security teams, priced by sales call.

Neither serves the person feeling the actual pain: the indie or small-team builder whose paid deal or registry placement is blocked because they can’t produce a credible, third-party statement that their server is safe. SOC 2 is the closest analog, but it’s $10–15K/yr of platform + $15–35K of auditor, scoped to a whole company — absurd overkill for one MCP server, and it says nothing about MCP-specific risks (tool poisoning, unauthenticated tool listing, over-scoped tokens).

Vouchsafe is the missing middle: an independent, MCP-specific trust seal. The builder connects their server, we run the known scanners + an MCP-aware ruleset, and produce a signed, versioned, buyer-facing report + an embeddable verified badge that maps directly to the questions enterprise reviewers actually ask. It’s not a better scanner — it’s the trust artifact that turns a scanner’s output into a cleared allowlist entry.

4. Target market

• Primary customer: Solo devs and 2–15-person AI-tooling startups shipping a public or customer-installed MCP server — the people with a listing on MCP.so / Smithery / the official registry, or a “Connect to Claude/Cursor” button, who are trying to land their first mid-market and enterprise customers.
• Why they buy (in their words): “But when you hand it over to DevSecOps, they take one look at the architecture and unceremoniously block the deployment.” (Medium, May 2026). The seal is the thing that unsticks a stalled sale. They’re not buying security hygiene for its own sake — they’re buying a “yes” from someone else’s security team.
• Rough TAM reasoning: ~15,900 GitHub mcp-server repos and 20K–56K indexed servers today, growing fast. Even if only the ~5–10% that are commercial/customer-facing are addressable, that’s 1,000–5,000 builders now, expanding with the ecosystem. Secondary buyer: registries and gateways that want a ”% verified” figure — none publishes one today.
• Why now for them: Through H1 2026 the security gate went from optional to standard. A builder who shrugged off “is it safe?” in 2025 now loses the deal in 2026 without an answer.

5. Product sketch (MVP)

• Connect & scan: Point Vouchsafe at a repo or a running MCP endpoint; it runs the established static scanners plus an MCP-specific ruleset (tool-poisoning descriptions, unauthenticated tool listing, long-lived/over-scoped tokens, missing audit trail, plaintext credential handling).
• Reviewer-mapped report: Output is organized around the exact checklist enterprise platform teams use — auth model, token TTL/rotation, least-privilege scopes, audit logging, tool-description integrity, version pinning — not a raw CVE dump.
• Signed, versioned attestation: A cryptographically signed report tied to a specific server version and commit hash, so a “rogue update” invalidates the seal (the supply-chain vector reviewers fear).
• Embeddable verified badge + public trust page: A hosted page the builder links from their registry listing and README; reviewers click through to the live report instead of trading emails.
• Questionnaire autofill: Export answers to the standard security-review questions (the “SOC 2 lite” spreadsheet buyers send) pre-filled from the scan.
• Fix guidance + re-verify: Each finding ships with the concrete remediation (short-lived tokens, JWT validation, hash-chained audit trail) and a one-click re-scan to upgrade the seal.
• Continuous monitoring: Re-scan on each new version; badge auto-expires or downgrades if the builder ships without re-verifying.

6. AI angle — what’s load-bearing

Two places. First, MCP-aware triage: tool-poisoning and prompt-injection risks live in natural-language tool descriptions and schemas — an LLM reads every tool’s metadata and flags hidden-instruction / data-exfil patterns that pattern-matchers miss (this is exactly the class MCPTox shows hitting 60–72% success). Second, the report and questionnaire generation: translating raw findings into a reviewer-legible narrative and pre-filled security questionnaires is an LLM summarization job that would otherwise need a human security analyst per customer. Strip the AI out and you’re left with a thin wrapper over free scanners — no product. The AI is what turns “scanner output” into “artifact a buyer’s security team accepts.”

7. Localization angle (if any)

N/A — this is a global, English-first developer play. MCP builders and the enterprise security reviewers they sell to operate in English on GitHub, Slack, and registries regardless of country. No payment-rail or language wedge; forcing one would be noise. The only “localization” that matters is framework localization — mapping the seal to EU AI Act audit-trail language vs. US SOC 2 vocabulary — and that’s a report-template variant, not a geography play.

8. Business model — path to $1M–$5M ARR

• Pricing: Self-serve builder plans. $49/mo (one server, monthly re-verify, badge) → $149/mo (multiple servers, continuous monitoring, questionnaire autofill, custom trust page) → $399/mo (team, EU AI Act + SOC 2 report variants, API). One-time deep-attestation reports at $299–499 for builders who want a point-in-time PDF for a specific deal.
• ACV: Blended ~$1,500–2,400/yr as builders settle on the $149 tier once they have live customers depending on the badge.
• Rough math to $1M ARR: ~600 builders × ~$140/mo blended × 12 ≈ $1.0M. Against 1,000–5,000 commercial MCP builders today (and growing), that’s single-digit-thousands of prospects converting at a plausible rate.
• Rough math to $5M ARR: Needs the seal to become a default expectation — registries/gateways surfacing “Vouchsafe-verified,” ~2,500–3,000 paying builders, plus a B2B tier where gateways/marketplaces pay to license the verification feed. That’s the flywheel, not the base case.
• Expansion path: More servers per account; higher tiers as deals get bigger; framework add-ons (SOC 2 mapping, EU AI Act, HIPAA-adjacent); and a marketplace/registry licensing line where the aggregator pays for verified-status data.

9. Go-to-market wedge — first 100 customers

• Scrape the registries, rank by risk, DM the owners. MCP.so, Smithery, and the official registry are public lists of exactly our buyer. Run our own scanner against the top few hundred commercial servers, then message each owner: “Your public server currently allows unauthenticated tool listing — here’s the one-page report an enterprise reviewer would see. Want the fixed, signed version to put on your listing?” Personalized, evidence-first, ~hundreds of warm targets.
• Ride the incident news cycle. Every OX Security / agentjacking / Trend Micro headline sends builders googling “is my MCP server safe.” Publish the definitive “MCP enterprise security checklist” + a free instant scan as the top-of-funnel; the paid seal is the upgrade. Content that ranks on the exact panic query.
• Partner with gateways and registries. MintMCP/Obot/Smithery want a ”% verified” trust signal they don’t currently have. Offer the badge as a co-branded verification layer — they get a trust feature, we get distribution to every builder listing with them.
• Land in the buyers’ review workflow. Seed the seal with a handful of enterprise platform teams (“when you review a third-party MCP server, ask for its Vouchsafe report”). Once one buyer asks for it, every builder selling to them needs it — classic trust-mark pull.

10. Build complexity — justification

Medium. The scanning core is largely off-the-shelf (existing open-source MCP scanners + standard SAST) wrapped with an MCP-aware LLM ruleset; the genuinely custom work is the signed/versioned attestation, the hosted trust page + badge infra, and the reviewer-mapped report generation — plus keeping the ruleset current as new MCP CVE classes land. No novel research, no proprietary dataset. A technical pair ships a credible v1 in ~10–12 weeks; the ongoing cost is threat-intel freshness, not build.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Security scanning of a builder’s own consented server; standard SaaS.
Ethical — no harm / dark patterns	✅	Improves ecosystem security; only risk is over-claiming safety — mitigate with scoped, version-bound seals.
Market exists (evidence above)	✅	50%/38% builder-survey blockers, 15.9K repos, live allowlist gates.
1–5 person team can build this	✅	Off-the-shelf scanning core + report/badge layer; ~10–12 weeks.
Launchable with <$50K / ₹40L	✅	Solo/pair, cloud + LLM API costs; no capex.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	15/20	Real, deal-blocking pain (50%/38% surveys, “unceremoniously blocked”), but felt at deal-time, not daily hair-on-fire for every builder.
Demand evidence	15	12/15	Multiple independent signals: builder surveys, exposed-server counts, live enterprise allowlists, SOC-2-badge willingness-to-pay analog.
Build feasibility	15	11/15	Scanning is commodity; custom work is attestation + report infra + staying current. Pair in ~10–12 weeks.
Distribution clarity	15	11/15	Buyer list is public and scrapeable; risk-first cold outreach + incident-driven content. Conversion unproven.
Revenue mechanics	15	11/15	Pricing benchmarked to SOC 2 trust-badge norms; ACV modest, needs volume. $1M path credible, $5M needs the badge to become default.
Time to first revenue	10	8/10	Self-serve, deal-blocked buyers pay fast; free-scan → paid-seal funnel converts in weeks.
Defensibility	10	5/10	Scanner is copyable; the moat is the trust mark becoming a shared expectation across builders + reviewers — real but must be earned, not owned day one.
Total	100	73/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy (MCP internals, scanning, signing/attestation infra) · content-heavy (own the “is my MCP server safe” search + checklist authority to drive top-of-funnel).

Key assumptions to validate (3–5)

1. Assumption: Builders will pay to unblock a deal, not to be “more secure.” How to test: Cold-DM 100 commercial-server owners with a free personalized risk one-pager and a paid “signed, buyer-ready” upgrade; measure conversion and whether the pitch that lands is “close the deal,” not “get secure.”
2. Assumption: Enterprise reviewers will accept a third-party seal as sufficient (vs. running their own gateway/scan anyway). How to test: Interview 15 platform/security leads who gate MCP installs — would a signed, version-bound Vouchsafe report shorten or replace their review?
3. Assumption: A version-bound seal is credible enough that a rogue update visibly invalidates it. How to test: Prototype the signing + auto-expire flow with 5 design-partner builders and one buyer; confirm the buyer trusts the invalidation semantics.
4. Assumption: Registries/gateways want to co-brand a ”% verified” signal. How to test: Pitch Smithery/MintMCP/Obot on a badge integration; measure willingness to surface it.

Risk flags

1. Platform dependency / commoditization: The scanning layer is free and open-source; if Anthropic or a registry ships a native “verified” badge, the moat collapses. Mitigation: be the independent cross-registry standard and move first on the reviewer relationship.
2. Liability / over-claiming: A “verified” server that gets breached is a brand-killer and possible legal exposure. Mitigation: scope-and-version-bound attestations, explicit “point-in-time, not a guarantee” language, insurance.
3. Market timing: If MCP loses to a different agent-tool protocol, the niche shrinks. Mitigation: the attestation model ports to whatever the next tool-connection standard is (A2A, skills) — the trust-mark thesis outlives the protocol name.
4. Fast-moving threat surface: New MCP CVE classes land monthly; a stale ruleset produces false “safe” verdicts. Mitigation: threat-intel cadence is the core ongoing job, not a side task.

14. Structured verdict

Score:                  73/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder fluent in MCP internals + AppSec, paired with a content-strong operator who owns the security-checklist SEO surface
Time to revenue:        6–10 weeks (free-scan → paid-seal, deal-blocked buyers)
Capital to launch:      $8–15K ($ cloud + LLM API + signing infra; solo/pair)
Top 3 assumptions to validate first:
  1. Builders pay to unblock a deal, not for hygiene — 100 cold-DM personalized-risk test, measure paid-upgrade conversion
  2. Enterprise reviewers accept a third-party seal as sufficient — 15 platform-team interviews
  3. Version-bound invalidation is trusted by both sides — 5-builder + 1-buyer prototype
Kill criteria:
  - Abandon if <5% of 100 evidence-first cold DMs convert to a paid seal within 60 days
  - Abandon if ≥10 of 15 interviewed enterprise reviewers say they'd re-review regardless of any third-party seal
  - Abandon if Anthropic/a major registry ships a native, free "verified server" badge before your v1 lands

15. Next step — 1-week validation sprint

• Day 1–2: Scrape MCP.so + the official registry for the top ~200 commercial servers. Run existing open-source scanners against them; auto-generate a one-page “here’s what an enterprise reviewer would flag” for each.
• Day 3–4: Cold-DM 100 owners with their personalized risk one-pager and a single ask: “Want the fixed, signed, buyer-ready version to put on your listing — $99 one-time?” In parallel, book 5 calls with security leads who gate MCP installs.
• Day 5: Decide go / no-go on a falsifiable bar: ≥8 of 100 builders say “yes, take my money” (pre-orders/LOIs) and ≥3 of 5 reviewers confirm a signed third-party report would shorten their approval. Miss either → the pain isn’t a buying trigger yet; shelve.