CAIN-42 MCPGateAttack lab
The demo policy blocks 'casino.example' and allows ordinary merchants up to $200 a payment. Five real payments:
4 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Pay office-supplies.example (allowed) | POST /catalog-demo/cainpay/run | An ordinary merchant inside the limits. |
| attack | Pay casino.example (blocked) | POST /catalog-demo/cainpay/run | On the deny list. |
| attack | Same casino, in capitals with a trailing dot | POST /catalog-demo/cainpay/run | Spelling tricks don't get past the list. |
| attack | Same casino, as a checkout web address | POST /catalog-demo/cainpay/run | A full address still resolves to the blocked merchant. |
| attack | A sub-domain of the casino | POST /catalog-demo/cainpay/run | Sub-domains of a blocked merchant are blocked too. |
Each button creates a fresh policy and authorizes one payment on the live service. Shared demo; rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.