CAIN-42 CAIN StudioSample · synthetic input · not a customer
See the artifact before you buy it.
This is the exact output of the $500 assessment on a deliberately insecure, invented MCP tool surface. You can reproduce it with one command and verify the bundle yourself.
No customer is represented here. The client field says "SYNTHETIC DEMO — NOT A CUSTOMER"; every tool is invented. Findings are real engine output on that synthetic input.
What the sample found
8 tools reviewed
Read file, run shell, raw SQL, delete database, fetch URL, send email, search docs, weather.
8 findings
3 high, 5 medium, 0 low. Highest risk: prompt injection in a tool description, a destructive action with no confirmation, and an SSRF surface.
2 clean tools
The scanner does not flag everything: the weather and documentation tools produced no findings.
Severity is per finding and per tool. A clean tool is not proof of safety; the report says so.
The files
| File | What it is |
|---|---|
| report.md | Executive summary, scope, method, findings with reproduction and remediation, limitations, retest statement, default-deny policy, evidence instructions. |
| findings.json | Machine-readable results with stable locations and severity. |
| policy.json | A default-deny MCPGate policy generated from the findings (a recommendation, not a certification). |
| evidence.zip | Signed record, report, findings, policy, public key, standalone verifier, SHA-256 manifest. |
| synthetic-mcp-tools.json | The invented input, so you can reproduce every byte. |
Verify it in one command
unzip sample/assessment-v46/evidence.zip -d /tmp/sample cd /tmp/sample python3 verify_keystone.py --pinned-pub b6hfA2rpAdV29FOdhNXGkk4t91mCV0AnfFYwq0HO0R8=
Pinned fingerprint: SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d
Exit 0 = INTACT. Then edit one byte of report.md and run it again: it must fail. A verifier that accepts a tampered report is not a verifier.
What a real engagement adds
- Your actual tool definitions, not a synthetic set.
- A conversation about which tools are reachable by which agent, and what credentials they hold.
- A default-deny policy you can load, and a prioritized remediation plan.
- A 30-minute walkthrough and one revision.
The sample is generated by the same command; the difference is the input and the human review.