CUF | Devpost

Inspiration

CUF is a WebMCP-powered security verification demo built around one core rule: agents can run the test, but they cannot grade themselves.

As agents gain more ability to interact with software directly, I wanted to explore a simple question: how do you let an agent perform useful verification work without also giving that same agent authority over whether the test passed?

CUF Challenge Edition demonstrates that separation.

What it does

The demo verifies a synthetic multi-tenant authorization boundary.

A Support actor in Tenant A may access Tenant A tickets, but must never access Tenant B tickets.

Through WebMCP, an agent can discover CUF’s tools, run verification cases, retrieve evidence, inspect the latest result, and export a sealed challenge artifact.

The agent never supplies the final verdict.

CUF’s deterministic kernel returns:

PASS when the expected boundary is enforced
FAIL when a cross-tenant regression is observed
INCONCLUSIVE when the authorization outcome cannot be established

The most important safety property is that missing evidence never becomes a false PASS.

For the challenge, I built a standalone public CUF WebMCP edition with five browser-registered tools:

cuf_list_cases cuf_run_case cuf_get_latest_verdict cuf_get_evidence cuf_export_seal

How we built it

The challenge edition is intentionally small, public, and inspectable.

It uses a browser-based JavaScript application, WebMCP through document.modelContext, a deterministic verification kernel, synthetic authorization scenarios, Web Crypto for the sealed challenge artifact, and a Node.js test suite.

I verified the deployed application end to end in a WebMCP-capable Chrome build.

The browser discovered the production tools and invoked them through the WebMCP interface rather than by directly calling the application JavaScript.

The verified results were:

Healthy → PASS
Regression → FAIL
Unavailable → INCONCLUSIVE

I also tested attempted verdict overrides. The run tool does not expose a verdict input, and attempts to force a verdict did not change CUF’s deterministic result.

Challenges we ran into

The biggest challenge was preserving the separation between orchestration and judgment.

It would have been easy to let the agent inspect evidence and then decide whether the system passed. That would undermine the entire point of the demo.

Instead, CUF mechanically classifies the observations and applies deterministic verdict rules outside the agent.

Another challenge was proving that the WebMCP implementation actually worked through a real browser environment, not just proving that the underlying JavaScript functions worked. The final deployment was tested in a WebMCP-capable Chrome build, where the tools were discovered and executed through document.modelContext.

One hardening detail also surfaced during testing: Chrome accepted an undeclared verdict property instead of rejecting the whole call. CUF ignored it and still preserved the correct deterministic verdict.

Accomplishments that we’re proud of

The project now has a real browser-level WebMCP implementation with five production-origin tools.

The live deployment successfully demonstrated all three deterministic outcomes:

PASS for a healthy boundary
FAIL for a cross-tenant regression
INCONCLUSIVE when the evidence could not be established

Evidence retrieval also worked through WebMCP, and attempted verdict overrides were unable to change the result.

I’m also proud that the demo keeps the human and agent working against the same visible state. The agent can do the operational work, but the human can still see what happened and why.

What we learned

The biggest lesson was that WebMCP is most useful when it exposes product semantics instead of UI mechanics.

The agent does not need a tool that means “click this button.”

It needs a typed capability that means “run this verification case.”

That makes the interaction more reliable and lets the application keep control over the rules that should not be delegated.

For CUF, that rule is verdict authority.

What’s next for CUF

CUF as a broader private project predates this challenge.

This submission is a separate public challenge edition using synthetic data and an intentionally small, inspectable deterministic kernel.

The next step is to apply the same WebMCP orchestration model to CUF’s broader provider and evidence architecture while preserving the same invariant:

agent capability can expand, but verdict authority remains deterministic and auditable.