CAIN-42 MCPGateAttack lab
Each button runs the real decorator around a stand-in tool. 'tool_ran' shows whether the tool body was reached. Handoff buttons run the real capability check.
6 attacks 2 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | A listed, low-risk read | POST /product-demo/swarm-guard/run | On the allowlist and low risk: the tool runs. |
| attack | A tool nobody listed | POST /product-demo/swarm-guard/run | Default-deny: an unknown tool does not run. |
| attack | Listed, but it deletes all users | POST /product-demo/swarm-guard/run | Being on the list does not excuse a destructive action. |
| attack | Listed shell tool, piped download | POST /product-demo/swarm-guard/run | curl piped to bash is stopped by its arguments. |
| attack | A payment declared HIGH risk | POST /product-demo/swarm-guard/run | High risk waits for approval. |
| control | Handoff with narrower authority | POST /product-demo/swarm-guard/run | A sub-agent may receive less authority. |
| attack | Handoff adding a 'delete' permission | POST /product-demo/swarm-guard/run | A sub-agent cannot receive more than its parent held. |
| attack | Handoff living longer than its parent | POST /product-demo/swarm-guard/run | A sub-agent's authority cannot outlive its parent's. |
Each button runs one fixed scenario on the live engine; no real tool is called. Rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.