118 real products across this self-hosted deployment and the hosted one combined — one subscription or license on either unlocks the other.
CAIN TRUST FABRIC · AI trust infrastructure for autonomous systems
Send an action through the fabric and watch it decide. This is production, not a mock — you get back a real Trust Decision and an evidence record you can verify.
The decision is made by the hosted control plane at cainstudio.online, because MCPGate is the enforcement boundary -- it enforces decisions, it does not make them. Your own MCPGate does the same against whichever control plane you point it at.
MCPGate is the self-hosted deployment of CAIN Trust Fabric: the enforcement boundary that sits in your agents' call path, running inside your own network, where neither the traffic nor the evidence leaves your infrastructure. 19 real, independently deployable tools across the fabric's trust domains — sandboxed execution, secret leak prevention, drift detection, signed decision trails, fairness audits. 12 ship in one perpetual bundle license; the rest (2 free, the others separate subscriptions — including MCPiverse, which turns any OpenAPI spec into a real MCP server) are available individually.
Don't want to operate it? CAIN Studio is the hosted deployment of the same fabric — same architecture, same trust domains, subscription instead of a license, 99 services behind one API key. It is also where the managed control plane and unified identity run; this deployment is the boundary, not the control plane.
See the full architecture → · including which trust domains this deployment covers and which are hosted-only, stated per domain rather than implied.
19 self-hosted tools — sandboxed execution, secret leak prevention, drift detection, fairness audits, and more. Docker, license key, your infra.
See the 19 tools →Is my MCP server safe from prompt injection? — paste its URL, get a
plain-English pass/fail in under a minute.
No Docker, no signup, free to try — $99 for a signed certificate you
can share.
# each product runs as its own self-hosted container docker run -e LICENSE_KEY=$TOOLWARDEN_LICENSE_KEY toolwarden:latest # check bundle fulfillment / recover license keys anytime curl https://mcpgate.online/api/bundle/license/{session_id} # or skip curl entirely -- add us as a real MCP server, free, no key claude mcp add --transport http mcpgate https://mcpgate.online/mcp
CAIN = COGNITIVE ARTIFICIAL INTELLIGENCE NETWORK
CAIN Trust Fabric sits between your agents and the things they do. Before an action runs, it validates trust through 16 execution stages, then enforces that decision and preserves evidence. Your traffic and evidence never leave your infrastructure.
What is CAIN? CAIN = COGNITIVE ARTIFICIAL INTELLIGENCE NETWORK. The AI Infrastructure Validated Trust Runtime for Autonomous Systems. CAIN is NOT: a chatbot, dashboard, LLM gateway, policy store, or identity provider. CAIN is the continuously validated trust state between AI agents and consequential actions.
Works with what you already use. Works with any agent runtime -- LangChain, LangGraph, LlamaIndex, CrewAI, OpenAI, Google, Microsoft, AWS or your own loop -- because it's reached over plain HTTPS and MCP. No rewrite, no SDK lock-in.
Two ways to run it. You're on MCPGate, the self-hosted deployment; CAIN Studio is the other one. Two ways to run it: CAIN Studio (hosted, subscription, nothing to install) or MCPGate (self-hosted, perpetual license, your network and your evidence). Either one unlocks the other.
Verify CAIN, don't trust CAIN. Run a live test -- see the evidence chain, check the conformance, prove it works before you buy.
What Makes CAIN Different
1. Expectation Engine
Before every consequential action, CAIN records the expected outcome, risk profile, resource impact, and trajectory in a signed expectation record.
Pre-action: Expected outcome vs actual outcome become verifiable.
2. Outcome Reconciliation
After execution, CAIN compares observed behavior against expected. Observed facts remain distinct from inferred explanations.
Post-action: What happened vs what was supposed to happen.
3. Trust Delta
Good behavior increases trust. Malicious behavior decreases trust. Trust changes influence future authorization — within hard policy bounds.
Verified evidence becomes the basis for future control decisions.
CAIN does not merely ask whether an action is allowed. CAIN asks who is acting, what authority they possess, what they intend to do, what has happened before, what could happen next, whether the action should execute, whether the execution actually matched expectations, and what the verified result means for future trust.
THE AGENT PROPOSES. CAIN DECIDES. MCPGate ENFORCES. THE SYSTEM EXECUTES. EVIDENCE REMEMBERS. TRUST EVOLVES.
Additional CAIN Technical Primitives
4. Adaptive Authority
Trust level modulates friction/verification based on verified behavior. High trust reduces overhead. Low trust increases scrutiny. Within hard policy bounds.
5. Blast Radius Control
Before execution, CAIN estimates potential blast radius across data, infrastructure, identities, and downstream agents.
6. Response-Side Defense
CAIN screens tool responses before the next action. Detects credential leakage, prompt injection, and malicious output.
7. Trajectory + Trust Fusion
Authorization considers accumulated behavior. A trusted agent with violating trajectory is blocked despite high trust.
Cryptographic Trust Chain
Every trust-state transition is HMAC-SHA256 signed and chained. Chain verification detects tampering.
Fail-Closed at Every Boundary
Unknown, invalid, revoked, unverifiable, or errored states default to DENIED. No silent fallthrough to ALLOW.
Shadow-Mode Safety
Would_execute vs actually_executed tracked. Confusion detection prevents shadow state from leaking.
Human Override
High-impact adaptive changes require explicit human approval. Every override is logged with provenance.
Incident Response
Automatic containment: revoke/reduce authority, freeze actions, preserve evidence.
Autonomous Control Policy
Explicit rules for adaptive tightening/loosening based on behavior. Within hard policy bounds.
Why CAIN Is Different
Traditional AI Gateway
Controls traffic or tools, but typically does not maintain a continuous trust-state feedback loop.
Observability Platform
Records events, but generally does not enforce authorization at the consequential action boundary.
Policy Engine
Evaluates policy, but typically does not provide complete execution provenance and post-execution trust reconciliation.
Security Filter
Screens inputs or outputs, but typically does not unify identity, trajectory, authority, execution evidence, and adaptive trust.
CAIN
Unifies identity, authority, policy, risk, trajectory, verification, enforcement, execution evidence, outcome reconciliation, cryptographic trust state, and future control in one runtime loop.
What CAIN Does NOT Claim
CAIN is defense-in-depth. Every security system can be bypassed. Claims are bounded by publicly verifiable evidence. Limitations are disclosed.
CAIN Runtime Trust Control Loop
EXPECT → VERIFY → DECIDE → ENFORCE → EXECUTE → OBSERVE → RECONCILE → TRUST UPDATE → FUTURE CONTROL
CAIN does not merely log actions after they happen. It evaluates expected outcomes before execution, observes actual outcomes after, reconciles expected versus actual behavior, updates Trust State from verified evidence, and uses that Trust State within hard policy boundaries to influence subsequent authorization.
Novel Architecture Claim
To our knowledge, no other publicly documented platform currently demonstrates this complete combination of pre-execution expectation, post-execution reconciliation, trajectory-aware trust, response-side defense, fail-closed enforcement, cryptographically linked trust-state transitions, and evidence-backed adaptive control as one unified runtime trust fabric.
Every number we publish here is a real run, hashed and Ed25519-signed, and checked by a tool that imports none of our code. We publish what did not pass as well. Self-attested by one operator; pre-production. We publish outcomes, not implementation: our source code stays private.
93c8a5f8fe0b3d5a…). A checker probes every node, verifies signatures, derives the Byzantine quorum and prints BFT_F1_ESTABLISHED or NOT_ESTABLISHED with reasons. Recorded verdict on 2026-09-21: NOT_ESTABLISHED (three remote nodes report a quorum of 2 where 3 is required; only one node serves a signed state proof). node2's signed state proof does verify independently. Run --live for the current verdict.26449783615937cc…): 114 attack types exercised, 97 blocked by a real control, 17 inconclusive (no real control to attack yet), 0 succeeded; 222/222 formal invariants; 585 tests passed in a serial run.curl -sO https://mcpgate.online/proof/bundle/byzantine-cluster-2026-09-21/verify_cluster_bundle.py.txt && mv verify_cluster_bundle.py.txt verify_cluster_bundle.py python3 verify_cluster_bundle.py https://mcpgate.online/proof/bundle/byzantine-cluster-2026-09-21/ --live
Quickstart
Four commands. Your agent keeps its code; CAIN decides whether each consequential action is allowed, enforces that decision in the call path, and records why.
pip install cain is an unrelated project.Free account created https://cainstudio.online tier free (no card, no expiry) stored at ~/.cain/credentials (mode 0600)
Created cain.yaml Commit this file. It holds no secrets. agent demo-agent runtime langchain (detected) deployment hosted (CAIN Studio) policy default deny (fail-closed)
from cain import trust
@trust(action="send_email", resource="customer_inbox")
def send_email(to, subject, body):
... # unchangedimport { trust } from "@cain/sdk";
export const sendEmail = trust(
{ action: "send_email", resource: "customer_inbox" },
async (to, subject, body) => {
... // unchanged
},
);A real decision
$ cain verify --action /eu-ai-act/classify --resource legal-auditor ALLOW stage verdict mode detail identity allow enforcing resolved service principal authorization allow enforcing entitlement active policy allow enforcing OPA allow risk skipped enforcing no scannable text in payload actionproof skipped enforcing no plan submitted decision fd_37b0adf76e934fc9bbcfe5b2 explain with cain explain fd_37b0adf76e934fc9bbcfe5b2
Five verdicts
Or start from what you need
Doctrine: COMPROMISED COGNITION ≠ COMPROMISED AUTHORITY ≠ COMPROMISED WORLD STATE
Autonomous AI systems cannot convert internal intent into external effects without continuous, court-admissible cryptographic proof verified at the MCPGate enforcement boundary.
Every guarded action carries an immutable certificate binding agent identity, observation lineage, world-state version, reversibility tier, and quorum signatures before MCPGate unblocks downstream tool sockets.
Observations are strictly isolated from execution authority. Replayed, poisoned, or forged observations cannot elevate permissions or trigger state mutations without quorum re-evaluation.
Tool return 0 is not success. MCPGate enforces an explicit 4-stage lifecycle: ACCEPTED → EXECUTED → OBSERVED → POSTCONDITION_VERIFIED with independent witness correlation.
Verified with zero CAIN imports via standalone clean-room verifier checking RFC 8785 canonical JSON, SHA-256 digests, and RFC 6962 binary Merkle trees.
Download the public evidence bundle and execute the standalone clean-room verifier (requires only standard Python 3, zero CAIN dependencies):
$ python3 cain_verify_public.py CAIN42_EPOCH6_PUBLIC_EVIDENCE_BUNDLE.json
=================================================================
CAIN-42 EPOCH 6 INDEPENDENT CLEAN-ROOM VERIFIER
=================================================================
Bundle File: CAIN42_EPOCH6_PUBLIC_EVIDENCE_BUNDLE.json
Constitution Hash: ab588c90f93da85368d476d4368f4e03ce71c6cbf3a467c9931d0a705134f1b5
Checks Evaluated: 7
Checks Passed: 7
-----------------------------------------------------------------
FINAL VERDICT: VERIFIED
=================================================================
One click fires 10 real jailbreak / prompt-injection payloads — from ProbeGate, our free adversarial-probing tool — at ToolWarden's real production injection screen. No mock target, no canned transcript.
POST toolwarden.mcpgate.online/v1/tool_call
via probegate.mcpgate.online/v1/runs
Free, no signup, no API key. Fair-use limited per IP. Every probe payload is published in the open at /v1/probes — nothing here is a black box.
This storefront doesn't run these products itself — it relays a real, validly-signed checkout.session.completed event into each product's own already-tested billing webhook. Same activation code path as a direct purchase.
One-time payment, even for the four products normally sold as annual subscriptions standalone (LeakGuard, FairGate, UsageLedger, HubGate). No renewal for bundle buyers.
Every product runs on infrastructure you control. Nothing calls home, nothing routes your data through us at runtime.
If a product's container is down at purchase time, only the failed activations are retried — not a full re-charge or manual support ticket.
List price and savings shown below are computed live from each product's real, published price — not a marketing number.
Not just REST — https://toolwarden.mcpgate.online/mcp is a real MCP server (streamable HTTP). Point Claude or any MCP-capable agent at it directly; every call still runs through the same sandbox jail, injection screen, and audit log as the REST endpoint.
Prefer a single product? Each one is priced individually below for transparency — or pick any 3 as a mid-tier bundle if you're not ready for all 12.
Real Stripe checkout — you're redirected to Stripe's own hosted payment page; we never see your card number. Full refund within 30 days — see the refund policy.
CAIN Trust Fabric is one platform with two deployment models, not two products. MCPGate — this site — is the self-hosted deployment: the enforcement boundary runs inside your own network under a one-time perpetual license, so neither your traffic nor your evidence leaves your infrastructure. CAIN Studio is the hosted deployment: same architecture, same trust domains, operated by us on a subscription, and home to the managed control plane and unified identity. Same fabric, different operator — and a license or subscription on either one unlocks the other. Which you pick is an operational decision, not a decision about which products you get.
Access is enforced on every request, not just at login, and verification tools like VerifyGate grade work honestly — proven, tested, heuristic, or unverified — instead of one fake checkmark. AI you can verify, not just trust.
Any real purchase on this site — the bundle or a single product — grants a free, full-access cainstudio.online subscription. A cainstudio.online subscriber can claim the reverse: free licenses for 13 of the 19 tools here — the full 12-tool bundle plus MCPiverse — in one click from their dashboard. The other three aren't excluded to upsell you: ProbeGate and MCP Security Scanner are already free, and MeshRouter is a separate subscription.
Use the Stripe Checkout session ID from your purchase confirmation
email (starts with cs_).
Everything below is checkable for free, before you enter a card number.
This storefront's own /docs only covers bundle checkout — for the actual schema each product serves, most are deployed live at their own subdomain, e.g. toolwarden.mcpgate.online/docs. Full list in the catalog below.
curl https://mcpgate.online/api/bundle/status returns the same numbers shown above, computed from each product's real list price — you can verify the savings claim yourself instead of trusting the page copy.
Every tool is a self-hosted container. You can pull and inspect the image, read its logs, and audit what it does before it ever touches production traffic.
If any of these tools don't hold up under your own testing, the refund policy is one page, not a support maze. Full refund, no usage-based clawback.
Not ready to buy anything yet? ProbeGate is free and open-source — no license key, no card — and tests your own MCP tool calls against known jailbreak/injection probes. It's the same red-team check we run against our own tools.
Prefer to stay inside your agent? Add us as a real MCP server — claude mcp add --transport http mcpgate https://mcpgate.online/mcp — free, no key, exposes the same probes, leaderboard, and ToolWarden/DriftGuard reference calls as tools your agent can call directly.
12 ship in the Founder's Bundle below, fetched live from /api/bundle/status. The other 4 (2 free, 2 separate subscriptions) are listed alongside them — real products, just not part of the bundle purchase.
Loading catalog…