Know what your AI agent can reach.
Boundline reviews AI agents and MCP servers for early-stage companies, and prepares the security documentation enterprise buyers ask for. Our reports are written to be shared with your customers.
Fixed fees, published below. The introductory call takes twenty minutes and carries no charge.
Services
Every engagement has a fixed fee and a written scope agreed before work begins. Introductory rates are available to our first clients; ask on the call.
AI agent and MCP security review A threat model, code and configuration review, and injection testing of your agent and its tools. 2 weeks From $2,500
The starter scope covers one agent, or up to two MCP servers. Larger systems are quoted after a scoping call.
Included
- A threat model of what the agent can reach and who can influence it
- Review of authentication, tool permissions and secrets handling
- Tool-poisoning and prompt-injection testing in your staging environment
- Findings mapped to the OWASP Top 10 for Agentic Applications, each with a severity and a specific fix
- A full report and a one-page summary for your customers
- One retest of fixed issues within 30 days
Not included
- Testing of production systems without written approval
- Ongoing monitoring
- Carrying out the fixes
Security readiness package Policies, a trust page and answers to your first enterprise security questionnaire. 10 business days $1,500
For teams whose next deal depends on a security review they have not faced before.
Included
- A kickoff call to map your stack, data flows and use of AI
- Eight policies written for your company, from access control to incident response
- Trust page copy, ready to publish
- Answers to one security questionnaire, up to 150 questions
- A ranked list of gaps to close before your next deal
- A walkthrough call at handoff
Not included
- A SOC 2 audit or attestation
- Legal advice
- Implementing technical controls
Security partner Continued support once a review or readiness package is complete. Monthly $500 / month
Available to existing clients. Three-month minimum, then month to month.
Included
- Up to two new security questionnaires answered each month
- Policy updates as your company changes
- Review of new agent features or MCP servers before release, up to four hours a month
- Replies within two business days
Not included
- On-call incident response
- Work beyond the monthly hours, which is quoted separately
Services are invoiced 50% to begin and 50% on delivery. Template purchases are credited toward a readiness package.
What a review examines
We look at an agent the way an attacker would: through every tool it can call and every piece of text it reads.
- Tool permissions
- Which tools the agent can call, with which credentials, and whether each is scoped to the task.
- Untrusted input
- How the agent handles instructions hidden in web pages, tickets, emails and tool output.
- Tool definitions
- Whether tool descriptions can be poisoned, and whether changes after approval are noticed.
- Authentication
- Token handling on your MCP servers, including audience checks and refusing to pass tokens through.
- Input validation
- File paths, shell commands and database queries built from model output.
- Consequential actions
- Which actions send, delete, pay or deploy, and whether a person approves them first.
- Secrets and logs
- Credentials in environment files, tool results, error messages and logs.
- Third-party servers
- Pinned versions, provenance and update policy for MCP servers you did not write.
How an engagement runs
A review takes about three weeks from first call to final report. Readiness packages move faster.
Introductory call
Twenty minutes to understand your product and what your buyers are asking for.
Scope and agreement
A fixed fee, a written scope and, for reviews, signed authorization to test.
Review
Work in your staging environment, with questions raised as they come up.
Report and walkthrough
A written report, a summary for customers, and a call to go through each finding.
Retest
Within 30 days, we confirm your fixes and update the report.
Templates
Ready-to-use documents for teams that prefer to start on their own. Each purchase is credited toward a readiness package.
Bharath Srividhya
Founder and principal reviewer
Who reviews your work
Boundline is led by Bharath Srividhya, an engineer working where AI systems meet security. He reviews every engagement personally.
He is an R&D Cybersecurity Consultant at GPTfy, researching applications of AI to security, and a Technical Fellow with Boston University's AI Safety and Alignment group. At Cyware Labs, a security automation company, he built an AI platform that generates working connectors for 1,000 API endpoints from their specifications. At 1Kosmos he worked on biometric authentication and identity management for enterprise clients, and at Cognizant he designed a multi-agent system with hybrid SQL and vector retrieval.
He is president of the BU Cybersecurity Association, where he leads hands-on penetration testing workshops, and is completing a B.S. in Computer Engineering at Boston University.
- R&D Cybersecurity Consultant, GPTfy2026 to present
- Technical Fellow, BU AI Safety and Alignment2026 to present
- AI and Analytics Intern, Cognizant2026
- AI Engineer, Cyware Labs2025
- Cybersecurity Engineer Intern, 1Kosmos2024
- President, BU Cybersecurity Association2025 to present
- Google Cybersecurity Certificate; IBM Generative AI EngineeringCertifications
Boundline is an independent practice. It is not affiliated with, and does not represent, any organization named here.
Field notes
Practical writing on securing AI agents and the servers they depend on.
Start with a twenty‑minute call.
Tell us what you are building and what your buyers are asking for. If we are not the right fit, we will say so and suggest who is. We are glad to sign a mutual NDA before discussing details.