MCP Security Quick Check · Free · Non-binding
Companies connect AI agents via MCP to DATEV, HR, CRM and more, and every connection is a door. We check which ones are open and whether that is legally compliant.
The problem
AI agents and MCP servers give AI real access to production systems, and hardly anyone systematically checks how far that access reaches.
An MCP server no longer connects a language model just with text, but with real systems: DATEV, personnel files, CRM, databases, mailboxes. An agent can therefore read data, write data and trigger actions, automatically and within seconds.
Most teams have never systematically answered this: what can each individual agent actually reach? Can it leak sensitive data to the wrong place? Can a manipulated input trick it into actions nobody intended? And is what is technically possible even compatible with GDPR and professional secrecy law (§ 203 StGB, the German Criminal Code)?
As long as these questions are open, the attack surface is unknown, and what is unknown can be neither secured nor demonstrated to clients and supervisory bodies.
What we check
We look at your MCP environment not only technically, but along all the layers that decide security and legal compliance.
Which agents and MCP servers exist, which systems are they connected to, and what can each agent concretely reach as a result?
Sensitive data exposure, destructive actions and indirect prompt injection: where could a tool do more than it should?
Authentication, client separation and audit log: is it traceable who triggered what, and do the access boundaries hold?
Known vulnerabilities in the dependencies and components in use: the gaps that are not in your own code.
Every finding is mapped against § 203 StGB, GDPR and the EU AI Act, so you know what is legally relevant.
You receive the top findings prioritised and in plain language, with concrete steps for closing each gap.
The difference
Technical scanners are a tool, not an answer. They report that something is conspicuous, usually in English and in technical terms. You have to translate the rest yourself.
How it works
You request the quick check via the form and briefly describe your environment. We get back to you within one working day.
We create an inventory of your agents and MCP servers and identify the most important findings along the five layers.
We discuss the results, put them in legal context and give you concrete actions, in plain language and without obligation.
Who it is for
Mid-sized companies that use or plan to introduce AI agents or MCP servers, especially with connections to ERP, HR, CRM or databases.
Tax advisors, lawyers and auditors, for whom any AI access to client data is bound by § 203 StGB and professional confidentiality obligations.
Free & non-binding
Briefly describe your environment. We will get back to you within one working day and agree the quick check with you.
Thank you, your request has been received. We will get back to you within one working day. A confirmation of receipt is on its way by email.
Prefer to talk directly? Book your free initial call:
Book initial call →The quick check is a technical readiness assessment, not legal advice and not a certificate or attestation. It provides indications and suggested actions for your own evaluation; a binding legal assessment remains with your tax or legal advisers.
Frequently asked questions