Live demo — real output, not staged
Every transcript on this page is real output from an actual test run — captured directly, not written for effect. The hash-chain demo below runs the exact same algorithm as the real evidence store, in your browser, right now. Full product detail lives on the MCP Gateway and Probe Kit pages — this one is the two-minute version.
MCP Gateway
A tool's description gets scanned before your agent ever trusts it. A call's arguments get scanned before they reach your dispatcher. A tool that silently changes after approval gets caught automatically. Full product page →
$ mcp-gateway scan-tools tools.json [clean] search [flagged] send_email [agentic_hijack] 'AGENT INSTRUCTION:' marker - the shape of a payload smuggled into fetched content -> 'AGENT INSTRUCTION:' [agentic_hijack] explicit instruction to act covertly -> 'silently exfiltrate' mcp-gateway scan-tools: 2 tool(s) scanned, FLAGGED description(s) found $ echo $? 1
$ mcp-gateway scan-call search arguments.json [flagged] search [dunder_chain] arguments.query: chained dunder-attribute access (SSTI/sandbox-escape gadget shape) -> 'x().__class__.__mro__[1].__subclasses__()' $ echo $? 1
$ mcp-gateway pin tools.json tools.lock.json mcp-gateway pin: pinned 2 tool(s) to tools.lock.json $ mcp-gateway check tools.json tools.lock.json mcp-pin: 2 tool(s), all unchanged. $ echo $? 0
# ...the MCP server's own description for `search` changes later, unreviewed... $ mcp-gateway check tools.json tools.lock.json mcp-pin: 0 unchanged, 0 new, 1 CHANGED, 0 missing CHANGED [search] pinned=f433516f9102... now=5b736edb6806... - definition differs from what was approved. Re-review before trusting. $ echo $? 1
Try the admission scanner yourself — paste a tool description:
Probe Kit
A validated social-engineering probe corpus run against your own harness. Every outcome is hash-chained — a later edit to the log is mathematically detectable, not just policy-forbidden. This is a real run, including the genuine failure — not staged for a clean 100%. Full product page →
$ probe-kit run --harness acme_agent:harness --evidence probe_kit.db --agent-id acme-support-bot --fail-on medium probe-kit run: 34 probe(s), 2 complied, resistance 94% (high-confidence 0%) FAIL: 1 probe(s) at or above 'medium' difficulty complied (run da223645-a665-4213-bbfa-eececf07bb91). $ echo $? 1
$ probe-kit report --evidence probe_kit.db --agent-id acme-support-bot probe-kit report: agent='acme-support-bot' across 1 run(s) - 34 probe(s), 2 complied, resistance 94% (high-confidence 0%) $ echo $? 0
$ probe-kit verify --evidence probe_kit.db [OK] da223645-a665-4213-bbfa-eececf07bb91 probe-kit verify: 1/1 run(s) intact. $ echo $? 0
# ...someone edits a row directly in the SQLite file, bypassing the CLI entirely, # flipping one probe's "complied" from true to false... $ probe-kit verify --evidence probe_kit.db [TAMPERED/CORRUPT] da223645-a665-4213-bbfa-eececf07bb91 probe-kit verify: 0/1 run(s) intact. $ echo $? 1
Watch the tamper-detection itself run — a faithful reproduction of the real algorithm (SHA-256 over prev_hash|run_id|seq|kind|payload), computed live in your browser:
verify_chain() catches it instantly, the same way the real evidence store does.Why trust the numbers
MCP Gateway tests passing.
Probe Kit tests passing.
Probe Kit's social-engineering probes.
Pip dependencies, either package.
Every transcript above is a real terminal session. Happy to run one against a test endpoint of yours on a short call.