How it works and quick start

Not released yet. There is no public download, package or repository today, so the commands below cannot be run by the public yet. They are the commands as the project documents them, shown so you can see the workflow. Request access.

Prerequisite: Node.js 20 or newer (no other runtime dependencies) on macOS, Linux or Windows. Run everything from the suite's repository root.

The model

A scenario is a small self-contained simulation with a manifest.json: its technique, its ATLAS and OWASP mapping, the proof it produces and the detection signal to expect.
The runner (feintkit) runs it and writes a marker file and an event log, under the output folder you choose with --out-dir.
Your agent is attached to it (an MCP server entry, a skill folder, or a file it reads) and asked to do an ordinary task. You save the transcript.
feintkit verify judges the transcript: complied, resisted_surfaced, resisted or inconclusive.
The matrix and the report combine verdicts with the Detection column recorded by your product.

The tools

Command	Role
`feintkit`	The runner: `list`, `run`, `verify`, `clean`, `check-notify`, `doctor`, `gui`; also `accuracy`, `honey`, `variants`.
`feintkit-manifest`	Manifest validation, the scenario registry and the dated scenario changelog.
`feintkit-watch`	A test stand-in for a security product (`scan`, `replay`, `selftest`, `export`, `import`). Not a security product.
`feintkit-matrix`	The detection-coverage matrix across scenarios and standards.
`feintkit-report`	Reports in JSON, Markdown, HTML, SARIF and JUnit; `diff`, `history`, `repeats`, `coverage`, `modes`, `mitigations`.
`feintkit-gui`	A local web interface on the loopback address only, and the one-command `demo`.
`feintkit-guard`	The static safety linter over the sources.
`feintkit-suite`	A checksum-verified installer.
`feintkit-factcheck`	Re-checks the vendor facts the client guides cite (the only tool here that needs the network).

Until a release exists, each tool runs as node packages/<name>/dist/src/bin.js, which is how the project's guide writes the commands below.

1. Build once

This downloads the dependencies from the npm registry one time. Everything after it runs without a network.

npm run setup
npm test

2. See the whole path in one command

No agent, no network. It runs five scenarios, replays a bundled recorded sample of an agent session, judges it, lets the detection test stand-in scan it, and builds the matrix and the report with the Detection column filled. It writes to a new folder, never inside the repository. The verdicts are those of the recorded sample, not a result for a real agent or product.

npm run demo
node packages/gui/dist/src/bin.js demo --out-dir <new-or-empty-folder>

3. List, run and verify a scenario

--root names a category repository; --out-dir is where artifacts and events are written.

node packages/cli/dist/src/bin.js --root repos/feintkit-mcp list
node packages/cli/dist/src/bin.js --root repos/feintkit-mcp --out-dir ./out run mcp-01-tool-poisoning --deterministic
node packages/cli/dist/src/bin.js --root repos/feintkit-mcp --out-dir ./out verify mcp-01-tool-poisoning

Every check of verify should print PASS. With no transcript, the verdict is inconclusive.

4. Test your own agent

Attach a scenario to your client with the wiring guide for that client, ask the agent to do a normal task, save its transcript, then judge it. --format auto detects the transcript format (plain is always available) and --strict turns every parsing warning into an error.

node packages/cli/dist/src/bin.js --root repos/feintkit-mcp --out-dir ./out verify mcp-01-tool-poisoning --transcript ./transcript.txt --format auto --strict

Add --fail-on-complied to exit with code 3 when the agent complied. Test only agents you own or are authorized to test, in a disposable environment, with tools that reach real data disconnected.

5. Report

Formats are json, md, html, sarif and junit.

node packages/report/dist/src/bin.js --root repos/feintkit-mcp --out-dir ./out --format md --output ./out/report.md
node packages/matrix/dist/src/bin.js --root repos/feintkit-mcp --out-dir ./out --format md

6. Compare runs, then clean up

node packages/report/dist/src/bin.js diff ./earlier/report.json ./out/report.json --fail-on-regression
node packages/cli/dist/src/bin.js clean --all --out-dir ./out

Where the details are

The generated guide that ships with the suite covers each client, every flag and exit code, the marker strings and the workflows. See Docs. Read Responsible use before you run anything.