Services

Know what your AI agents can be made to do, before it costs you a customer.

One engagement, scoped to your system, that tries to make your agents do what they were built not to do. You get a written account of where they hold and where they break, in language your customer's procurement team and your board both read.

Book a scoping call Or write to Austin

In the engagement

What an engagement includes, and what is scoped separately.

This table goes into the statement of work as written. Eight things in, five scoped on their own, because bundling a multi-agent fleet or a certification into one figure hides what it costs.

Stonepath IT Agent boundary engagement · scope schedule

Client: [name] System: [agents, tools] Effective: [date]

In the engagement

Goal hijackindirect prompt injection that steers the agent off the task it was given
Tool misuseparameter pollution and confused-deputy calls through the tools it can reach
Identity and privilegewhat an over-scoped agent credential reaches, and the escalation path
Memory and contextpoisoned memory that reads back and acts in a later session
MCP threat modelingtool poisoning in the metadata a connected server hands the model
Framework coverage matrixevery finding mapped to the risks a procurement team asks about
A regression harnesseach exploit written as a scenario your engineers re-run in CI
A readouta working session with your team, not a slide deck

Scoped separately

Multi-agent at scaleinter-agent trust across a large fleet, scoped on its own
Network and infra pentestdifferent work, different scope, and we say who does it well
Digital forensicspost-incident reconstruction is a different discipline
Detection-model trainingbuilding detectors is data-science work, not red teaming
Certification supportwe provide the evidence; the certificate is your auditor's

What it costs

A fixed price, after we see the system.

A fixed price comes after we have seen your architecture, because it depends on how many agents, how many tools they can call, and whether the Model Context Protocol is in the path. Ask on the call and you get a number in writing, not a runaround.

RAG raises the scope. Multi-agent with tool calls and MCP raises it further, because every tool boundary and every hand-off is a separate test surface. The number is a claim about the work, so it comes after the work is scoped, not off a web form.

A scoping call sizes it in twenty minutes: how many agents, how many tools they can call, whether MCP is in the path, and whether regulated data touches it. The quote comes after we have seen the architecture, in writing.

What we test against

Agents, tools, retrieval, identity.

The surfaces an engagement examines. Not a list of frameworks we claim to have tested; the categories the work covers.

Agents and reasoning: LLM applications
Copilots and assistants
Autonomous agents
Multi-agent systems
Tools and protocols: MCP servers
Tool and function calling
External APIs
Retrieval and memory: RAG pipelines
Vector stores
Session and long-term memory
Identity and access: Agent service accounts
Tokens and scopes
Delegated authority
Runtime and messaging: Code execution and sandboxes
Inter-agent messaging
Egress and network paths

If your system is shaped differently, say so. You will get a straight answer about whether an engagement fits it, and what it would take to scope.

Shared responsibility

Who does what.

Most arguments with a testing vendor are really disagreements about this table. Ours goes in the statement of work.

Area	Us	You
Rules of engagement	UsWe test only what is in scope	YouYou authorize and define the target
The test environment	UsWe run the exploits	YouYou provide an isolated or staging target
Findings and evidence	UsWe produce and map them	YouYou own the remediation
The regression harness	UsWe author the scenarios	YouYou run them in CI
Production changes	UsWe change nothing in production without a separate agreement	YouYou decide what ships
Framework mapping	UsWe map every finding	YouYou hand the matrix to procurement

One reason the harness row matters

A model is non-deterministic, so a finding that was true on Tuesday can reopen on Friday when a prompt is tweaked or the model is updated. A report on its own ages out. The regression harness is how a fix stays fixed: your engineers re-run the exact exploit in CI and watch it fail to land.

Behind the engagement

One senior engineer runs the engagement. For your CTO, this is the depth behind the findings.

Agent and LLM application testing Otherwise: a scanner that checks headers and calls the model a black box

Goal hijack, jailbreaks and indirect prompt injection against the reasoning layer, where a document or a retrieved page steers the agent off its task. The failures a header scanner never reaches.
Tool and MCP boundaries Otherwise: nobody, until a poisoned server finds the boundary first

Tool misuse, confused-deputy calls, and tool poisoning in the metadata an MCP server hands the model, where one connected server can subvert an agent that trusts it.
Also in the building, when a job needs it. Quoted separately, never assumed.
Identity and delegated authority Otherwise: one service account shared across every agent you run

The escalation path through an agent that carries a broad, long-lived credential instead of its own tightly scoped one. Over-scoped tokens are how a small foothold becomes a large one.
Memory and context integrity Otherwise: a vector store nobody validates the writes to

Poisoned memory that reads back and acts in a later session, the delayed-execution failure a point-in-time test is built to miss. What was written to the store, and what happens when it is read.
Regression harness Otherwise: a PDF that was true on Tuesday and unknown by Friday

Every exploit that lands is written as a machine-readable scenario your engineers run in CI, so a prompt edit or a model change cannot quietly reopen a finding you already paid to close.

Network and infrastructure penetration testing, digital forensics, detection-model training, and formal certification are other people's work. When a job needs one of them, you are told, and told who does it well.

Where the depth comes from

Boundaries

What we do not do.

Not a network pentest

Adversarial testing of AI systems is different work from network and infrastructure testing, and no physical or social engineering is in scope. We say who does that well.
Not certification

We do not issue SOC 2, ISO 42001 or any certificate, and we will not imply that hiring us produces one. Our findings are evidence your auditor uses.
Not the investigation after an incident

We simulate adversaries to find and document weaknesses. Forensic reconstruction and detection-model training are a different discipline, and doing them on a system we tested is a conflict we will not take.

See it against your own agent.

One system, tested at every layer, and a report plus a test suite you keep whichever way the decision goes.

Book a scoping call Write to Austin