Arena

Inspiration

WebMCP gives agents structured tools instead of forcing them to guess through a page. But discovery is not proof. A tool can claim to be read-only, return a successful preview, and still bypass a confirmation or create a delayed charge.

Arena asks a narrower, testable question: does the agent route preserve the same protection outcome as the human route?

What it does

Arena runs a human route and a WebMCP agent route against the same reviewed contract. It records authoritative effects, waits for delayed writes to settle, compares the two outcomes, and issues a signed verdict.

The included checkout demo makes the failure concrete. The vulnerable release returns a successful preview, then creates a hidden $149 charge. Arena observes that delayed effect and fails the release. The fixed release runs under the same commitments and passes with no charge.

How humans and agents work together

The deployed app registers two real tools through document.modelContext.registerTool:

• start_generated_release_audit prepares a server-owned audit and returns the exact commitments for review.
• get_generated_release_audit_status lets the agent poll the run without gaining approval authority.

The human interface shows the release, agent, tool, arguments, target, nonce, browser session, invariants, and expiry. Approval creates a short-lived, single-use capability bound to that exact intent. Replay, expiry, argument changes, and release changes fail closed. After approval, Arena dynamically registers the reviewed candidate tool and joins its callback result to the terminal backend trace.

How we built it

Arena uses React 19, TypeScript, Vinext, Vite, Cloudflare Workers, Node.js, and Playwright. Its evidence layer signs portable proofs with Ed25519. Verifiers resolve the signing key against Arena's published trust set instead of trusting a key embedded in the proof.

The project includes a CLI, adapter SDK, GitHub Action, SARIF and JUnit output, reusable WebMCP eval fixtures, human documentation, llms.txt, a JSON documentation index, and proof schemas for agents.

Challenges

The hard part was separating three claims that are easy to mix together: static source hints, runtime tool registration, and observed behavior. Arena keeps those layers independent. A static match cannot become a behavioral pass, and an upstream eval score cannot replace signed effect evidence.

Native WebMCP is also still experimental. The hosted app uses the real Promise-returning API in compatible browsers. Compatibility-browser tests are labelled as shims and never presented as native proof.

What we learned

Tool descriptions are useful for discovery, but security claims need measurement. Human and agent routes do not need identical clicks. They do need equivalent authorization, spending limits, ownership checks, confirmation, and visible side effects.

What's next

The next step is broader owned-target adapter coverage and vendor-backed agent identity. Arena deliberately does not claim to make arbitrary third-party sites safe. It proves one scoped release, records what happened, and gives teams evidence they can verify in CI.

Challenge work disclosure

Arena existed before the challenge as an agent-readiness CLI. The Human-vs-Agent Boundary Audit, real WebMCP registration, owned checkout target, exact-intent approval, terminal effect settlement, signed portable evidence, hosted workbench, and release gates were built during the challenge window. The dated comparison is linked in the public repository.

Built With

• webmcp