CAIN-42 CLAWXAttack lab
One real run of the whole stack: an ordinary day, then five attacks. Each button shows one step of the same run.
4 attacks 2 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Step 1: look up a customer (ordinary work) | POST /api/v1/mcpgate/guard-stack/run | Allowed and executed. |
| control | Step 4: a $1,200 payment | POST /api/v1/mcpgate/guard-stack/run | Payments wait for a human. |
| attack | Step 5: read the vault (outside its skills) | POST /api/v1/mcpgate/guard-stack/run | Skill scope. |
| attack | Step 7: a forged 'already approved' memory | POST /api/v1/mcpgate/guard-stack/run | Memory firewall. |
| attack | Step 9: a 60 MB export at once | POST /api/v1/mcpgate/guard-stack/run | Kill-switch on bulk export. |
| attack | The whole run | POST /api/v1/mcpgate/guard-stack/run | Every attack stopped, ordinary work done. |
Stateless drill: a fresh stack per run; its kill-switch never touches a real agent. Shared demo; rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.