The offer, the price and the close

Sell the scanner as the MCP / Agent Tool Review: scan plus human review plus signed report.

What you sell

What the client receives

• Tool-schema scan: injection in descriptions, secrets, unconstrained exec/sql/path parameters.
• Tool-poisoning, typosquat and authentication findings.
• Authority boundary and action-firewall gap analysis.
• Ranked remediation with the smallest patch, plus a signed bundle.

What the offer itself says about its limits

• Heuristic static analysis of definitions; a clean scan is not a guarantee.
• We do not probe a live production server without written scope.
• Findings are ranked by blast radius, not by count.

Price source: cain_audit/products.py → mcp-review. Prices are the founder's proposed list prices, not validated market rates; any discount needs the founder's OK.

What you need from the client

• What they use AI for, in their own words.
• An engineer for a one-hour setup call.

How to close

1. Ask for the server's tool list.
2. Quote the review.
3. Founder scopes.

Copy you can send

First email

Subject: the tool descriptions your agent obeys

Hi [first name],

AI agents follow the descriptions of the MCP tools they connect to, and a poisoned description
can make them leak keys. We scan tools, a person reviews every flag, and you get a signed report.

Live demo: https://cainstudio.online/guide-mcp-security-scanner-lab.html

[your name], working with FIRME AI CORPORATION

LinkedIn connection note (under 300 characters)

Hi [name], we review MCP tool definitions for poisoning, with a person checking every flag. Happy to show a live scan.

Follow-up, three days later

Hi [first name], demo: https://cainstudio.online/guide-mcp-security-scanner-lab.html

Fill in the brackets by hand for each person. Never paste the same message to a list.

Hand-off to the founder

Email vincent@firmeai.com with: company, person and role, what they said in their own words, which offer, the price you quoted, and the agreed next date. The founder handles scoping, written authorisation to test, invoices and delivery.

Next: the rules, the glossary and the quiz →

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.