CAIN-42 CAIN StudioCAIN MCP Security Engineer
Find poisoned or over-privileged MCP tools, harden their definitions, and put a deciding boundary in front of them.
Who it's for
Engineers who run, build or approve MCP servers and the agents that use them.
Why it's in demand
MCP became the default way agents reach tools. Dedicated MCP security courses and a hands-on MCP certification launched in 2026, and dozens of CVEs were filed against MCP systems early in the year. Sources →
Exam
- Requires your Novice certificate ID
- 20 questions · 30 minutes
- 85% (17/20) to pass · server-graded
- Certificate ID C42-CMSE-…
Modules
1How MCP works, and where it breaks12 min✓2Tool poisoning and shadowing14 min✓3Least privilege for MCP servers and tokens12 min✓4Hardening and proving a fix13 min✓5Running MCP behind a deciding boundary12 min✓
Built on this code
cain/mcp_proxy.pycain/telemetry.pykeystone/family_verify.pykeystone/mcp.pymcp-security-scanner/engine.py