073 first flagged12 Oct 2026 +7d · nothing yet

Tool Fuzz: CI security tests for MCP servers that move money

GitHub Action that fuzzes agent tool endpoints with adversarial LLM arguments; fintechs publishing MCP servers or agent toolkits pay.

Competitive · ToFu derives tool checks automatically

Written for: Small startup team

Next step

Find which payments or banking API companies list an MCP server in their developer docs (check Plaid, Mercury and Ramp first). Call the engineer who owns it and offer a free fuzz run on their public tools in return for a 30-minute review of the findings.

Why now

Fintechs are exposing payments and banking actions as MCP tools, and middleware like Delta MCP shows agents increasingly batching tool calls into code. Earlier cards covered runtime firewalls (Agent Gate). This is the pre-deploy developer tool for the team that writes the tool: it catches wrong-tenant account IDs, negative or overflowing amounts, currency mismatches and path traversal before release. Agent incidents are now a reporting matter, so a clean fuzz report becomes a procurement document.

What became possible

ToFu shows you can read a tool's existing code, automatically derive the security rules it should enforce, and fuzz the boundary where the orchestrator wrongly treats LLM-generated arguments as trusted. APEX-Harm and the cross-session artifact paper add realistic finance-workspace attacks and attacks that persist across sessions to test against.

Two ways in

Tool Fuzz Action
Parses MCP server and function-tool definitions plus their handlers, generates adversarial argument sets in the style of ToFu, runs them against a sandboxed build and fails CI when a semantic check is missing.

Customer
Platform and security engineers at fintechs with public MCP servers or agent SDKs
Model
Free for open-source repos; $500-2k per month per private repo for finance-specific rule packs and history
Tool Safety Report
A dated, signed report of the tools tested, attacks tried and fixes made, formatted to answer the AI-agent questions in bank vendor questionnaires.

Customer
Fintech API providers selling to banks
Model
Per-report fee plus annual retest subscription

Competition

Competitive

There are three risks. Promptfoo, Akto or Snyk could add a finance template cheaply. The market of fintechs with public MCP servers is still small. And banks have not standardized AI-agent questionnaire items, so the report's format may need to change often.

Full competition notes (12 competitors)

Generic MCP fuzzing in CI is already taken. jakk, mcplint, mcpsec, RedCell, MCPFang and mcp-test are free and open source, several of them ship GitHub Actions, and Promptfoo already uses a payments MCP server as its example. Akto and Snyk sell the enterprise version. A new entrant cannot win on "fuzz MCP tools in CI with adversarial arguments" alone. What remains open is narrower. None of the tools I found has a library of payment-specific semantic checks. That would cover amount and currency tampering, sign flips and overflow, idempotency-key reuse and replay, payee or account substitution, limit and velocity bypass, missing step-up confirmation on irreversible transfers, and mismatches between tool annotations and actual side effects. The product would read the handler code to work out which invariants should exist, then fail the build when they are missing. In other words, it would be a fintech domain pack, not a fuzzer. The second product is the more open opportunity. I found guides on answering MCP vendor questionnaires (SSOJet) and Akto's bank RFP guidance, but no signed, dated test attestation that a fintech API provider could hand to a bank's third-party-risk team. That artifact could plausibly be the paid part, with the fuzzing engine possibly built on open-source tools. There are three risks. Promptfoo, Akto or Snyk could add a finance template cheaply. The market of fintechs with public MCP servers is still small. And banks have not standardized AI-agent questionnaire items, so the report's format may need to change often.

jakk
Black-box MCP security scanner that ships as a GitHub Action. It runs curated single-call adversarial probes, is read-only by default and fails CI only on reproducible evidence. This is the closest match to the CI action, but its probes are generic and not specific to finance.
mcplint
Open-source Rust tool that does coverage-guided fuzzing, protocol validation and security scanning of MCP servers. Its init wizard generates a GitHub Actions workflow.
mcpsec
Open-source security scanner and protocol fuzzer for MCP servers. Its README credits it with real crash bugs, including one in the MCP Python SDK. I found no dedicated GitHub Action for it.
mcp-test / pytest-mcp-plugin
Pytest-based MCP test harness with a GitHub Action and JUnit output. It has opt-in security packs for path traversal, SQL injection and shell injection. It is a test framework, not a fuzzer.
RedCell
Actively exploits running MCP servers and maps findings to the OWASP MCP Top 10. It is built for CI: it exits non-zero when it finds something and produces SARIF and HTML reports.
MCPFang
Uses LLM agents as attackers to run multi-step attack chains against MCP servers, mapped to OWASP MCP risks. This overlaps directly with the idea of adversarial arguments generated by an LLM.
mcpwn
Open-source MCP tester for prompt injection, tool poisoning, data exfiltration and SSRF.
Promptfoo MCP provider and red team
Calls MCP tools directly with arguments and has red-team plugins for BOLA, BFLA, PII and SQL injection, and it runs in CI. Its docs use a payment-processing MCP server as the example, so it is the strongest incumbent for this exact use case. Promptfoo is now part of OpenAI.
Akto Agentic Red Teaming
Commercial platform that discovers MCP servers and tools and runs thousands of probes for tool permission escalation, schema violations and injection. It markets CI/CD deployment and compliance reporting, including RFP guidance for regulated banks.
Snyk MCP-Scan (formerly Invariant Labs mcp-scan)
Snyk's experimental scanner for MCP servers and agent skills. It covers prompt injection, tool poisoning and toxic flows, so a big-company incumbent sits next door.
ToolFuzz (ETH Zurich research)
Research paper and tool that uses taint analysis to generate natural-language inputs that break agent tools and expose documentation errors. This is probably the 'ToFu' method the pitch refers to. It is academic, not a product.
AgentPay Sentinel MCP
An MCP listing that claims pre-flight checks on agent payments for amount tampering, replay, revoked tokens and budget overruns. This is a runtime guard, not CI fuzzing, but it targets the same money-moving failure modes.

Checked 2026-10-12

Risks

ToFu is a research prototype; automatically derived checks may be noisy on real codebases
Snyk, Socket or runtime agent-security vendors could add tool fuzzing quickly
Many fintech MCP servers are thin wrappers around APIs that already validate input, which shrinks the number of findings

Strong team fit; tech readiness and market pull and open space are the weak point (6).

tech 6 · pull 6 · space 6 · fit 8 · build 7

Exposed

PANW CRWD

Companies that could benefit or be threatened. News and context, not investment advice.

Momentum of its main topic

Agents AI

168 developments this week +53 vs last week

Stage: Coverage

Sources

What happened next

+7d · 19 Oct 2026 nothing yet. No product launches, funding rounds, acquisitions, or significant trend coverage related to this opportunity were found after the October 12, 2026 flag date. With only seven days elapsed, it is premature to expect a market response.

How the record works

Status history

2026-10-12 Flagged as buildable

Build Brief → Open in Earlyink