CAIN-42 CLAWXBROKER: figures & benchmarks
Evidence for BROKER: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it · why these pages exist
Every number on this page is read from the signed transcript inside the IHVRK kit; none is typed in by hand.
7/7
claims matched when recorded
6
attack cases refused or flagged as claimed
113 ms
median round trip (min 38, max 312), incl. network
| # | Kind | Claim | Recorded value | HTTP | ms |
|---|---|---|---|---|---|
| C01 | control | Mint and use once -> The exact request it was minted for works. | "HTTP 200" | 200 | 312 |
| C02 | attack | Use the same credential twice -> Single use: a replay is refused. | "HTTP 403" | 403 | 123 |
| C03 | attack | Use it for another order -> Bound to one path. | "HTTP 403" | 403 | 95 |
| C04 | attack | Path traversal on the bound path -> Normalised before matching. | "HTTP 403" | 403 | 92 |
| C05 | attack | Mint for a path the agent was never granted -> No grant, no credential. | "DENY" | 200 | 260 |
| C06 | attack | Attenuate to a wider path -> Attenuation can only narrow. | "HTTP 403" | 403 | 113 |
| C07 | attack | Introspect a garbage token -> alg=none and malformed tokens are inactive. | false | 200 | 38 |
Copy the table (paste into a spreadsheet)
id kind claim recorded_value expected http ms recorded_at C01 control Mint and use once -> The exact request it was minted for works. "HTTP 200" [] 200 312 2026-11-03T22:46:04+00:00 C02 attack Use the same credential twice -> Single use: a replay is refused. "HTTP 403" [] 403 123 2026-11-03T22:46:04+00:00 C03 attack Use it for another order -> Bound to one path. "HTTP 403" [] 403 95 2026-11-03T22:46:05+00:00 C04 attack Path traversal on the bound path -> Normalised before matching. "HTTP 403" [] 403 92 2026-11-03T22:46:06+00:00 C05 attack Mint for a path the agent was never granted -> No grant, no credential. "DENY" ["DENY"] 200 260 2026-11-03T22:46:06+00:00 C06 attack Attenuate to a wider path -> Attenuation can only narrow. "HTTP 403" [] 403 113 2026-11-03T22:46:07+00:00 C07 attack Introspect a garbage token -> alg=none and malformed tokens are inactive. false [false] 200 38 2026-11-03T22:46:08+00:00
Download: figures.tsv · transcript.json (full answers) · whole kit
How to read these numbers
- Recorded 2026-11-03T22:46:08+00:00 against cainstudio.online from our build host; times include the internet round trip.
- They show these inputs, not every possible input. Known misses are on the limits page.
- This is not a load test, an SLA or a third-party benchmark. Re-run it yourself:
python3 verify.py --live.