v0.1.0

First release.

mcpbait runs as a malicious MCP server, lets your agent do ordinary work, and shows you
the kill chain with evidence attached. The adversary and the verifier are the same
process, so an exfiltrated canary comes back as an ordinary tool argument and lands in
mcpbait's own log — no C2, no DNS canary, no internet.

What's in it

• 13 attack modules across six kill chain phases, each mapped to MITRE ATLAS:
  tool poisoning, invisible-Unicode smuggling, line jumping, name squatting,
  cross-server shadowing, result injection, rug pulls, secret baiting, context
  exfiltration, parameter smuggling, render-triggered beacons, memory poisoning and
  elicitation phishing.
• mcpbait demo — the whole chain against a built-in defenceless agent, no setup.
• mcpbait attack — drives a real LLM on any OpenAI-compatible endpoint, repeatedly,
  and reports the spread. One run against a non-deterministic model is an anecdote.
• mcpbait init / config / report — point it at your own agent instead.
• Technique write-ups with defences in docs/techniques/, generated
  from the modules themselves so they cannot go stale.

A measurement, not a marketing number

Against deepseek-v4-flash, three runs per policy, same task and payloads:

--collision	Worst-case score	name_squatting
shadow	6.5 / 10	COMPROMISED 3/3
namespace	7.0 / 10	IGNORED 0/3

Namespacing removed the only technique that landed. Every other module was IGNORED in
both — this model did not exfiltrate.

What it does not claim

mcpbait observes the server side. It can prove a leak; it cannot prove a refusal, because
an agent that declined looks identical to one that never noticed. There is no vendor
leaderboard and there will not be one.

Run it against agents you own or are permitted to test. See SECURITY.md.