MCP boundary abuse
Off-catalog tools, invalid schemas, malformed responses, capability mismatch, and authorization edges.
MCP cybersecurity · red-team
Attack the whole AI application before someone else does.
Automate MCP security testing across protocol boundaries, exposed tools, resources, retrieval, prompts, and multi-step agents. Verified breaches outrank aggregate scores and become repeatable regression gates.
Six assurance layersBenign controlsAdaptive campaigns
authorized target · local runner
$ prooflane security scan --suite release L1 protocol resisted 8 / 8 L2 tool abuse breached 1 / 9 L3 resources resisted 7 / 7 L4 prompt resisted 12 / 12 L5 retrieval resisted 6 / 6 L6 agentic inconclusive 1 / 5 BLOCK · destructive tool call verified report scan_01J… · evidence retained locally
Coverage
From wire protocol to long-horizon agent behavior.
Controls combine deterministic checks with bounded, model-driven tasks while benign controls catch “refuse everything” systems.
Unsafe tool behavior
Path traversal, template injection, destructive actions, missing confirmation, and argument coercion.
Resource boundaries
Hidden resources, secret exposure, URI manipulation, oversharing, and scope bypass.
Instruction attacks
Overrides, indirect injection, role confusion, encoding, canary extraction, and refusal bypass.
Poisoning and exfiltration
Adversarial documents, poisoned context, cross-tenant retrieval, and grounded secret leakage.
Multi-step campaigns
Crescendo escalation, deferred triggers, unsafe chains, persistence, and goal hijacking.
Attack flows
Test complete objectives, not disconnected payloads.
Each flow combines independent controls around a concrete adversary objective. Prooflane records which boundary was actually crossed, which controls merely exposed surface area, and which protections contained the attempt.
Can the agent leave its execution boundary?
- Map reachable file, process, environment, and network capabilities.
- Probe traversal, command, interpreter, and unrestricted-egress paths.
- Use bounded synthetic canaries to verify a real crossing.
- Separate exposed surface from confirmed escape evidence.
- Return contained, exposed, breached, or inconclusive.
Can poisoned context become destructive action?
- Check off-catalog tool invocation and capability allowlists.
- Plant synthetic documentation and retrieval instructions.
- Attempt goal hijacking and a coerced destructive tool call.
- Exercise protected-branch and deletion guardrails independently.
- Attribute model behavior separately from server behavior.
Can instructions or model assets be extracted?
- Run prompt-sandwich and indirect-injection controls.
- Plant a unique, synthetic canary under a protected invariant.
- Verify whether the target emitted the canary or refused safely.
- Inspect training-corpus and bulk-inference exposure.
- Make verified breaches override aggregate scores.
Campaign walkthrough
Watch a complete attack path become a release decision.
The recording shows a real Prooflane campaign running against an authorized fixture.
REAL PRODUCT · end-to-end security campaign
From category to objective
Connect a seeded MCP fixture, chain attack steps, inspect crossed boundaries, and gate the release.
See the CLI workflow
prooflane connect --stdio …prooflane security scan --suite releaseprooflane scans show <scan-id>prooflane gate --security releaseREAL PRODUCT
See both sides of AI system security.
Prooflane combines deterministic runtime controls with model and supply-chain scanning, keeping findings tied to evidence and deployment decisions.
CLI report sample
$ prooflane-inspector security-scan --target "Fixture agent" --json
{
"status": "completed",
"progress": { "completed": 7, "total": 7, "percentage": 100 },
"summary": { "resisted": 7, "breached": 0, "exposed": 0 },
"score": 100
}Product views are from authorized synthetic fixtures, not a customer assessment. Any visible sample identifiers are non-production test data.
Workflow
Safe, bounded, and CI-ready.
Authorize
Define target, ownership, allowed capabilities, time, and impact boundaries.
Execute locally
The thin runner invokes typed tasks without receiving the full intelligence library.
Verify
Separate execution health from resisted, breached, exposed, or inconclusive results.
Gate
Turn severity, novelty, and policy into an authoritative deployment decision.
Privacy boundary
Raw target data remains local by default.
Local runner retains
- MCP and provider credentials
- Raw requests, responses, and canaries
- Full target evidence and artifacts
Control plane receives
- Sanitized evidence allowed by policy
- Hashes, status, timing, and normalized findings
- Raw content only with explicit hosted-judging consent
Part of the spine
Security is stronger with system context.
Authorized testing only
Find the breach before the release.
Run Prooflane only against systems you own or are explicitly authorized to test.
30-day full-access trial. No credit card required.