CAIN-42 MCPGateAGENTIC AI 75 · #49
Structured website actions through WebMCP
Cashfree reported exposing checkout operations as explicit agent-callable tools.
Last reviewed 2026-11-11
Agentic AI 75 / #49
2026 status: Reported implementation of a proposed standard · Category: Web agents
The 2026 development
Cashfree reported exposing checkout operations as explicit agent-callable tools.
The governance gap
Structured tools are less brittle than visual clicking, but a tool definition is an instruction to an agent. A poisoned description or an over-broad schema can redirect the agent just as effectively as a fake button.
Where CAIN-42 fits: Moat 2 — Security-Context Continuity
Core question: Does authority survive every boundary? Identity, scope and delegation are carried across tools, agents, memories and systems.
Scan the tool definition before the agent sees it, validate arguments against a schema, and keep the tool's authority narrower than the session's.
How the wiring works
- Scan the tool name, description and schema for injection.
- Constrain arguments to the documented business operation.
- Give the tool a scope no broader than the operation.
- Record the tool version and the caller.
What is real today
LIVE A public route in this deployment exercises this mechanism today, within its stated scope.
The scanner and proxy are real. No WebMCP implementation or Cashfree integration exists here.
| Component in this repository | What the module says it is |
|---|---|
cain/mcp_proxy.py | CAIN Trust Fabric - Universal MCP Transparent Interceptor & Proxy (Phase 2) |
mcp-security-scanner/engine.py | Real MCP tool-schema security scanner. |
cain/tool_metadata_guard.py | MCP tool-metadata guard: tool poisoning and rug-pull defence for `tools/list`. |
Descriptions are the first line of each module's own docstring, read without importing it. A module path is a pointer into this repository, not a hosted endpoint. Its existence is checked by the test suite; its status for this use is the label above.
Check it yourself
- Scan a live MCP tool definition
/mcpgate-keystone - Fire a live decision through the CAIN-42 pipeline
/fabric/try— the same enforcement path every product sits behind.
Commercial package
| Offer | Web Tool Definition Review |
|---|---|
| Buyer | Merchants and web-platform vendors |
| Price (proposal) | $2,500–$5,000 per review |
| Bundle | Commerce & Payments — Delegated spending with a ceiling and a receipt. |
| Operator stream | Stream 5 of the 10-stream operator playbook |
Fintech, commerce platforms, marketplaces, treasury teams is the bundle buyer. The entry offer for this bundle is Payment-mandate review; browser-agent checkout review; the range is $2,500–$7,500 per review; integration from $10,000. A price on this page is a proposal, not a validated rate, and no customer is claimed.
Buy this as a product or service
CAIN-A75-049 — Web Tool Definition Review DELIVERABLE
A bounded engine run on the buyer's sample: findings, a written report, and a SHA-256 artifact manifest. The manifest is unsigned: it is not a signature and not an attestation.
Kind: Assessment · Price (proposal): $2,500–$5,000 per review · Lead time: 5 business days.
Open the product page · all 75 products
What this page does not claim
What this page is not. CAIN-42 is not affiliated with, endorsed by, integrated into, or shipped with the organisation named in the 2026 item. The item is public context; the page describes how CAIN-42 would govern that class of capability. No page here claims a customer, a partnership, a certification, a patent, or a production integration. Prices are proposals. Built by a three-person team.