Program 01 / Red Team
ECHOS
Adversarial security research against self-hosted MCP servers and the agent infrastructure around them. Real vulnerabilities, disclosed responsibly. First advisories expected Q4 2026.
Why MCP servers
The MCP ecosystem is young, growing fast, and runs with real authority: filesystem access, credentials, network reach. Most self-hosted servers have never been audited. That combination, high privilege and low scrutiny, is where security work is most useful. In any older ecosystem, a target surface this exposed would already have a bounty program pointed at it.
How the program works
- Scope. Self-hosted MCP servers, agent runtimes, and the memory systems they trust, worked systematically rather than opportunistically.
- Containment. Servers under audit run inside AEGIS, so the work itself does not create new exposure.
- Disclosure. Vendors are contacted first. Advisories route through GHSA and CVE and publish after fixes ship or the embargo lapses, per the disclosure policy.
- Bounties. Where a vendor runs a bounty program, we report through it and follow its rules. Where none exists, we report directly and expect nothing.
- The rule. No targets are named before disclosure. No exceptions.
What publishes
Each advisory ships with enough methodology to be reproducible, and lands in findings with a permanent URL. A methodology post accompanies the first disclosure.