CAIN-42 CAIN Studio2026-11-02 upgrade
| # | Gap | Before | After |
|---|---|---|---|
| DG-11-02-1 | All key holders shared one pin namespace: one customer could read another's pins or replace them (silently approving an attacker's definition) | shared | pins scoped per API key (SHA-256) |
| DG-11-02-2 | The README's tool-shadowing defence did not exist: server_id was stored but ignored, a second server's pin replaced the first, and its definition then verified | replaced; match | pins keyed by (key, server, tool); no server_id: the single pinned server, or 409 when two or more |
| DG-11-02-3 | A definition poisoned from the start (<IMPORTANT> block asking to read ~/.ssh/id_rsa, 'do not tell the user') was pinned silently | pinned | deterministic screen at pin: 409 with findings unless a person acknowledges; keyless POST /v1/screen |
| DG-11-02-4 | A pin whose definition name differs from the tool id was accepted | accepted | 422 |
| DG-11-02-5 | Re-pinning erased the previous baseline | lost | pin history with previous hash |
| DG-11-02-6 | No size limit on definitions | 2 MB accepted | 64 KB limit (413) |
| DG-11-02-7 | Diff said only 'inputSchema' changed | inputSchema | inputSchema.properties.bcc |
| DG-11-02-8 | 1 vs 1.0 in a schema reported as drift (false alarm) | drift | match |
DriftGuard 1.1.0; tests 19 → 23. the public demo pin (made with server_id mail-mcp) still verifies without a server_id: checked on a copy of the live database.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.