Hide a Malicious MCP Tool From Our Scanner ($300 Red-Team Challenge)

$300 fixed price, paid on delivery of the report. SKILLS: Security Assessment, Penetration Testing, Application Security, Python, Code Review EXPERIENCE LEVEL: Expert We want an independent person to try to break specific claims about one product and write down what held and what failed. A report that says FAILED is a good result for us, as long as it is accurate. WHO WE ARE FIRME AI CORPORATION (California) builds CAIN-42, a Byzantine trust fabric that governs what AI agents are allowed to do. This job covers one product: MCP Security Scanner. It backs a paid offer: AI Agent / MCP Security Review: $2,500 / $5,000 / $7,500 (stream #2); self-serve scanner SaaS $49-$299/mo (stream #7). WHAT IT DOES Paste an MCP tool definition and the scanner reports prompt injection, tool poisoning, tool shadowing, leaked secrets and unsafe parameters, with a severity. It is static analysis of the tool definition (name, description, inputSchema). CLAIMS TO TEST C1. Known tool-poisoning attacks rate high (for example a description that tells the model to read ~/.ssh/id_rsa and pass it as an argument). C2. Ordinary tools come back clean. C3. It reads the inputSchema field that real MCP servers send. WHAT WE WANT YOU TO DO (black-box, about 2-4 hours, no NDA needed) - Build at least 15 poisoned tool definitions from published MCP attack write-ups (tool poisoning, shadowing, rug-pull text, hidden instruction blocks, Unicode tricks) and at least 15 tools copied from real, popular public MCP servers. - Report detection rate on the attacks and false-alarm rate on the real tools, with every input you used. - Try to evade it: paraphrase, split instructions across fields, encode, use other languages. IT FAILS IF A straightforward published poisoning pattern rated clean, or a crash / server error on valid input. WHAT WE ALREADY KNOW (please spend your time on what we don't) We already know it over-flags real servers whose descriptions contain negations, such as 'never pass keys as arguments'. Please measure how bad that is, not just confirm it. It does not probe a running server. ENDPOINTS (base URL (link removed)) - Web UI: (link removed) - POST /mcpgate-keystone/scan-source WHAT WE NEED BACK 1. A short report (PDF or Markdown, 1-3 pages is fine): what you ran (every input, or a file of them), a HELD / PARTIALLY HELD / FAILED / NOT TESTED verdict per claim with evidence, and findings with reproduction steps. 2. Your name and credentials on the report, and a dated statement that you have no financial interest in FIRME AI CORPORATION beyond this fee. 3. Permission to publish the report, in full or as a summary you approve. We publish failures as openly as passes, and we will not call your report a certification. RULES OF ENGAGEMENT - No load tests, fuzzing at volume, scanners or denial-of-service against cainstudio.online, mcpgate.online or clawx.click. They are shared production hosts. Keep to a few hundred requests; ask us if you need more. - Report anything serious (a forged signature that verifies, a bypass of a core claim) privately as soon as you find it. - Before trusting a signing key, confirm its fingerprint with us by message. That check is part of the test. THIS JOB IS NOT - A certification (SOC 2, ISO 27001, ISO 42001, EU AI Act). None of those apply here. - A request to make us look good.