Quick answer
The public case study describes a bounded, synthetic evaluation of the ComputeID MCP Gateway. It reports that passport-authorization failures were blocked in all three unauthorized-access cases, malformed tool-call requests were rejected at the gateway boundary, and an unavailable upstream returned an upstream_unreachable result.
It also reports a limitation: replay protection was not implemented in the evaluated configuration. A previously valid credential could therefore be replayed and pass through. That is a useful finding, not a universal security verdict.
Scope and method
This page summarizes a partner-authored public post rather than presenting a new independent audit. The evaluation was bounded and synthetic, and it focused on the gateway boundary rather than on production traffic, a complete threat model, or a certification decision.
Passport failures and unauthorized access cases
Malformed tool and call requests
Behavior when the registered upstream is unavailable
What the public case study reports
These observations describe the tested cases and configuration. They should not be read as proof that every authorization failure, malformed request, or upstream condition is handled identically in every deployment.
The replay-protection gap
The case study states that replay protection was not implemented in the evaluated configuration. A valid credential that had already been used could be replayed and pass through. This is the most important result because cryptographic identity and replay prevention solve different problems: a credential can be authentic and still be reused outside the intended freshness window.
What this does not establish
- It is not a production certification, independent audit, or universal security guarantee.
- The public post did not evaluate timeout behavior versus connection refusal.
- It does not measure McpVanguard or VEX Protocol behavior, and it should not be presented as a product benchmark for either.
- It does not establish that a cryptographic identity layer alone prevents every class of tool misuse.
Read the source case study
The underlying public post was written by Praveen Gajjala, Founder of ComputeID. It contains the original scope, observations, and explicit disclaimer.
Open the LinkedIn post