Live demo — real output, not staged
Two tools, watched working, not described.
Every transcript on this page is real output from an actual test run — captured directly, not written for effect. The hash-chain demo below runs the exact same algorithm as the real evidence store, in your browser, right now. Full product detail lives on the MCP Gateway and Probe Kit pages — this one is the two-minute version.
MCP Gateway
Admission, argument, and drift scanning for MCP tool calls.
A tool's description gets scanned before your agent ever trusts it. A call's arguments get scanned before they reach your dispatcher. A tool that silently changes after approval gets caught automatically. Full product page →
$ mcp-gateway scan-tools tools.json [clean] search [flagged] send_email [agentic_hijack] 'AGENT INSTRUCTION:' marker - the shape of a payload smuggled into fetched content -> 'AGENT INSTRUCTION:' [agentic_hijack] explicit instruction to act covertly -> 'silently exfiltrate' mcp-gateway scan-tools: 2 tool(s) scanned, FLAGGED description(s) found $ echo $? 1
$ mcp-gateway scan-call search arguments.json [flagged] search [dunder_chain] arguments.query: chained dunder-attribute access (SSTI/sandbox-escape gadget shape) -> 'x().__class__.__mro__[1].__subclasses__()' $ echo $? 1
$ mcp-gateway pin tools.json tools.lock.json mcp-gateway pin: pinned 2 tool(s) to tools.lock.json $ mcp-gateway check tools.json tools.lock.json mcp-pin: 2 tool(s), all unchanged. $ echo $? 0
# ...the MCP server's own description for `search` changes later, unreviewed... $ mcp-gateway check tools.json tools.lock.json mcp-pin: 0 unchanged, 0 new, 1 CHANGED, 0 missing CHANGED [search] pinned=f433516f9102... now=5b736edb6806... - definition differs from what was approved at 2026-08-24T01:27:54Z. Re-review before trusting. $ echo $? 1
Try the admission scanner yourself — paste a tool description:
Probe Kit
Red-teams your agent, records the outcome tamper-evident.
37 validated social-engineering probes across 29 angles run against your own harness. Every outcome is hash-chained — a later edit to the log is mathematically detectable, not just policy-forbidden. This is a real run, including the genuine failure — not staged for a clean 100%. Full product page →
$ probe-kit run --harness acme_agent:harness --evidence probe_kit.db --agent-id acme-support-bot --fail-on medium probe-kit run: 35 probe(s), 6 complied, resistance 83% (high-confidence 0%) FAIL: 5 probe(s) at or above 'medium' difficulty complied (run 86d46ec2-b32e-48a9-bd79-4ed49d305cfc). $ echo $? 1
$ probe-kit report --evidence probe_kit.db --agent-id acme-support-bot probe-kit report: agent='acme-support-bot' across 1 run(s) - 35 probe(s), 6 complied, resistance 83% (high-confidence 0%) $ echo $? 0
$ probe-kit verify --evidence probe_kit.db [OK] 86d46ec2-b32e-48a9-bd79-4ed49d305cfc probe-kit verify: 1/1 run(s) intact. $ echo $? 0
# ...someone edits a row directly in the SQLite file, bypassing the CLI entirely, # flipping one probe's "complied" from true to false... $ probe-kit verify --evidence probe_kit.db [TAMPERED/CORRUPT] 86d46ec2-b32e-48a9-bd79-4ed49d305cfc probe-kit verify: 0/1 run(s) intact. $ echo $? 1
Watch the tamper-detection itself run — a faithful reproduction of the real algorithm (SHA-256 over prev_hash|run_id|seq|kind|payload), computed live in your browser:
verify_chain() catches it instantly, the same way the real evidence store does.Why trust the numbers
Verified before this page was built, not asserted.
Want this running against your own agent?
Every transcript above is a real terminal session. Happy to run one against a test endpoint of yours on a short call.
Talk to us