Terms of Service

Last updated: 2026-09-12 · Effective 2026-09-12

These Terms govern your use of the mcp-server-audit command-line tool and the professional security audit services and website operated by Guigui Wang ("Correctover", "we", "us"), an independent software operator. By using the tool or purchasing a service you agree to these Terms.

1. The free CLI

mcp-server-audit is open-source software provided under the MIT License. You may use, copy, modify, and distribute it on the terms of that license. It is provided "AS IS", without warranty of any kind. The tool performs a defined set of 14 automated static checks; it is a screening aid, not a guarantee that a configuration is free of vulnerabilities.

2. Professional audit services

Paid audits are scoped professional services. The Standard Manual Audit covers one MCP server or agent component up to an agreed scope and applies our 116-check manual methodology; the Enterprise/Custom tier is defined in a written scope or statement of work. Deliverables, turnaround, and price are those described on the pricing page or in the agreed scope. We work asynchronously and do not require calls for the Standard tier.

3. What an audit is — and isn't

We deliver findings with evidence (source location, snippet, reproduction) and a signed conformance receipt for the agreed scope and point in time.
A security audit is a professional opinion based on testing and analysis; no audit can guarantee the absence of all vulnerabilities, and results apply only to the submitted version and scope.
"CCS (Correctover Conformance Shape)" is our own verification model described in an individual Internet-Draft; it is not an RFC and is not endorsed by the IETF or the Model Context Protocol organization.

4. Your responsibilities

You confirm you own or are authorized to submit any code, configuration, endpoint, or trace material for testing.
You will not use our services to test or attack systems you are not authorized to assess, or to obtain offensive tooling against third parties.
You provide accurate billing and contact information.

5. Fees, taxes & payment

Listed prices are exclusive of applicable taxes. Payments are processed by our Merchant of Record (currently Creem / Armitage Labs OÜ), which is the seller of record and collects/remits VAT/GST/sales tax in supported countries; the tax-inclusive total is shown before payment. The Standard audit begins only after payment (or an agreed invoice) clears. Enterprise engagements are billed per the signed statement of work.

6. Refund policy

Before audit work begins (scoping confirmed, no materials assessed): you may cancel for a full refund within 7 days of payment.
After work has begun: fees are non-refundable for work performed; if we are unable to deliver the agreed scope for reasons on our side, you may choose a pro-rata refund of undelivered work or delivery when the issue is resolved.
The free CLI is free and involves no charge.

7. Delivery & scheduling

Standard audits target delivery within approximately five (5) business days after scope confirmation and receipt of materials. Delays caused by incomplete or late materials extend the timeline. Deliverables are sent to the contact email you provide.

8. Confidentiality

We treat submitted materials as confidential, use them only to deliver the engagement, and delete them per our Privacy Policy unless an NDA states otherwise. We do not publicly disclose your identity or specific findings without your written consent; we may use anonymized, non-attributable vulnerability knowledge to improve checks.

9. Acceptable use

You may not resell or misrepresent the signed report, forge or alter receipts/reports, attempt to disrupt the website or its infrastructure, or use the service for any unlawful purpose or to enable unauthorized access to systems.

10. Intellectual property

The scanner and our methodology/tooling remain ours (the scanner under MIT). You own your submitted materials. Reports and receipts are licensed to you for the purchased engagement and may be shared with stakeholders; they may not be altered or presented as an independent third-party certification.

11. Disclaimer & limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE TOOL AND SERVICES ARE PROVIDED "AS IS" WITHOUT WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. WE ARE NOT LIABLE FOR INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES. OUR TOTAL LIABILITY FOR A PAID ENGAGEMENT SHALL NOT EXCEED THE FEES YOU PAID FOR THAT ENGAGEMENT.

12. Responsible use of findings

All research and reporting follow responsible-disclosure practices. We do not provide weaponized exploits, attacks on third parties without authorization, or advice intended to circumvent security or legal controls.

13. Changes & governing terms

We may update these Terms; material changes will update the date above and, where required, be communicated to active customers. Disputes will first be handled in good faith over email; if unresolved, they are subject to the laws applicable to the contracting party identified on your payment receipt, without regard to conflict-of-law rules.

14. Contact

Support and questions: wangguigui@correctover.com.