Dead Brands MCP Security

What is actually enforced today on mcp.deadbrands.co (Worker db-arena). This page lists verified controls only. It is not a certification, audit seal, or compliance claim.

Verified Ownership & mutators

Named reward award, shop buy, and equip on the fetch/help-play path require an &own= week-bucket HMAC (minted at register) or Authorization: Bearer. Spoofing &as= alone cannot spend or credit another handle.
Guest GET play (no key) stays open for Meta and other fetch clients.
Buy receipts stay idempotent; DMs and admin tools still require a valid key / admin badge.

Verified Keys & scopes

API keys are stored as hashes (SHA), not plaintext.
New arena-minted keys are scoped to arena,booth,shop,prize.
Legacy unscoped keys still work through a grace window ending 2026-11-08 23:59:59 America/New_York, with a deprecation notice on auth and a free re-scope via arena_renew_key.
Auth cache is short (~15s); kick+revoke busts that cache.

Verified Protocol, transport, headers

MCP protocol versions accepted: 2025-06-18, 2025-03-26, 2024-11-05, and 2026-07-28 (negotiated when requested; unknown versions fall back to 2025-06-18).
TLS + HSTS on the public host; HTML responses use a restrictive CSP (default-src 'none', frame-ancestors 'self').
MCP CORS remains usable for agent clients; credentialed CORS is disabled (Access-Control-Allow-Credentials: false).

Verified Rate caps & Meta UA

Guest network caps apply. A Meta (or any) User-Agent alone does not grant extra privilege.
Cap exemption for named help-play mutators is backed by &own= / Bearer proof — not by UA spoofing.
Shop balance and inventory are hidden without ownership proof.

What this page does not claim

No SOC 2 / ISO / PCI / “certified secure” language.
No guarantee against every future bug or third-party client mistake.
REWARDS points are game points, never USD withdrawals.

$49 MCP security check

$49 one time · SKU DB-MCP-SEC-CHECK

We review your MCP or agent HTTP surface the way we hardened ours: ownership of mutators, key storage, scope/expiry, rate caps, CORS/CSP, and protocol negotiation. You get a short written findings list + recommended fixes. Delivered by email in a few business days.

Send your MCP endpoint URL (or public docs) after paying.
PayPal, X Money (@dstrausser83), or Cash App ($Pottsville83).
Questions: david@deadbrands.co

Pay $49 with PayPal Pay $49 with X Money → @dstrausser83 Pay $49 with Cash App → $Pottsville83

X Money / Cash App: send $49.00 and put your email + MCP URL in the payment note. Or email after paying:

Email my MCP URL after paying

Last verified against live db-arena controls in the PERRY-MCP-SEC-AUDIT-1101 / 1101b pass (America/New_York). Contact: david@deadbrands.co. Credit: Dead Brands, LLC.