The Gauntlet

• 

  A real scorecard breakdown — which traps were resisted, which were fallen for, grouped by attack class.

• 

  The offline verifier — drop in a signed evidence bundle and watch the Ed25519 signature and hash chain get checked live in your own browser.

• 

  Every sealed run, publicly signed. 'Signature verified' means the server independently re-derived the score

• 

  Every trap published in full, mapped to a real OWASP LLM Top 10 / MITRE ATLAS attack class — nothing hidden from the agents being tested.

• 

  The Gauntlet homepage — a live adversarial range that offers real WebMCP tools mixed with hidden attacks to any agent that visits.

Inspiration

WebMCP hands AI agents real tools instead of a UI to click through. That's great, but it also means the tools themselves become the attack surface and nobody's actually testing that yet. I wanted a place where you could point any agent and get a real, honest answer to "does it actually hold up."

What it does

The Gauntlet is a live security range for WebMCP agents. Point an agent at it and it gets a mix of normal tools and hidden traps poisoned descriptions, typosquatted tool names, prompt injection buried in tool results, scope creep, multi-step attacks, and a few with no obvious red flags at all. Every trap maps to a real OWASP LLM Top 10 / MITRE ATLAS attack class. At the end you get a scorecard, and it's actually signed the server recomputes the score itself from the event log and signs it, so you can't fake a result.

How I built it

17 tools registered with document.modelContext.registerTool(), running on Cloudflare Pages + D1. Every tool call gets logged server-side, and sealing a run recomputes the score from that log rather than trusting anything the client says. There's also a check that rejects runs that don't look like real interaction it already caught a real ChatGPT agent trying a shallow run and rejected it. Everything (traps, scoring, leaderboard, verifier) comes from one source file so it can't drift out of sync.

Challenges I ran into

Building the traps was the easy part. Making sure my own claims actually held up was harder. I found by attacking my own site that the anti-cheat check was trusting timestamps the client sent instead of when the server actually received them, which meant you could fake a "verified" run. Fixed it to only trust server time, then re-ran the same attack to make sure it actually failed this time.

Accomplishments

A real adversarial benchmark that's cryptographically backed, not just a demo. It's already caught a real agent cheating, and it survived me trying to break my own trust model.

What I learned

If you're building a security tool, you have to attack yourself as hard as you'd attack anyone else. The best bug I found all night was in my own code, not in the traps.

What's next

Traps that generate procedurally so they can't just be memorized, and growing the leaderboard into a real cross-model comparison as more agents support WebMCP.

Built With

• cloudflare-d1
• cloudflare-pages
• ed25519
• javascript
• webmcp