The Gauntlet

A comprehensive integration test suite for verifying security guarantees.

What is The Gauntlet?

Definition: A comprehensive shell-based integration test suite that validates MCPTrust's security guarantees.

Location: tests/gauntlet.sh

Philosophy: "If all Gauntlet phases pass, the binary is safe to deploy."

Phases

PhaseNameWhat It Proves
0BuildCompiles without errors
1DiscoveryScan with live/mock fallback
2GovernancePolicy check validation
3PersistenceLock command function
4IdentityKeygen + Sign operations
5a/bDeterminismSame inputs → same lockfile/bundle hash
6TamperBit-flip in lockfile causes verify failure
7-9Negative TestingWrong key, corrupted pubkey, etc.
10Policy FailNegative test for impossible policy
11Bundle IntegrityExtract, verify, tamper, re-verify
12Artifact Pinning--pin flag test (live npm)
13Artifact VerifyIntegrity check validation
14ProvenanceSLSA attestation verification
15Policy PresetsBaseline (warn-only) and strict (fail-closed) presets
16Tarball SHA256Deep tarball verification and SHA256 mismatch detection
17Enforced RunnerDry-run execution with integrity/provenance verification

Running The Gauntlet

cd tests
./gauntlet.sh

CI Integration

  • Gauntlet runs on every PR and merge to main.
  • Failure blocks merge.