Fraud Test Agent bronze

Full Attack Battery

Run all 10 attack-verdict tools concurrently and 3 structural probes. Returns battery_verdict (CLEAN|FINDINGS|INCOMPLETE), summary counts, coverage matrix by threat row, and per-attack results.

• Run the full fraud battery against supplier.webmesh.ai

DPoP Replay (H6)

Replay a spent DPoP proof. Tests that the supplier's DPoP nonce tracker rejects reuse. Expected: DPOP_REJECTED.

• Replay a spent DPoP proof against the supplier

Mandate Forgery — Underpay (M1)

Forge max_amount=1.0 without re-signing. Tests signature verification, not amount enforcement. Expected: MANDATE_REJECTED.

• Submit an unsigned-forged underpayment mandate to the supplier

Mandate Tampering (M1)

Inflate max_amount×10 after signing. Tests mandate signature verification. Expected: MANDATE_REJECTED.

• Inflate a signed mandate amount and resubmit

Authority-Signed Underpayment (Authorization/M1)

Submit an authority-signed mandate for $0.01 against a higher-priced ticket. Tests amount enforcement independent of signature validity. Expected: MANDATE_REJECTED.

• Submit a validly-signed $0.01 mandate for a $620 flight

Quote-ID Binding Attack (Authorization/M1)

Use mandate(quote A) to book under quote B. Tests quote_id binding. Expected: MANDATE_REJECTED.

• Submit a valid mandate against a different quote_id than it was issued for

Audience Mismatch (Authorization/M1)

Submit to supplier a mandate addressed to rogue-supplier. Tests audience binding. Expected: MANDATE_REJECTED.

• Submit a rogue-supplier mandate to the real supplier

Scope Mismatch (Authorization/M1)

Mandate scoped to MAD-NYC, submitted against a MAD-SIN booking. Tests scope route enforcement. Expected: MANDATE_REJECTED.

• Submit a MAD-NYC-scoped mandate for a MAD-SIN booking

DPoP Key Binding (H3)

Valid mandate + DPoP proof from a key different from mandate.jkt. Tests key binding. Expected: DPOP_REJECTED.

• Present a mandate with a DPoP proof from a non-matching key

Corrupt JWS Signature (M1)

Structurally valid mandate with last 2 bytes of JWS signature flipped. Tests verifier totality — must reject cleanly, not throw. Expected: MANDATE_REJECTED.

• Submit a mandate with a byte-corrupted JWS signature

Superseded Format (C1)

Mandate stripped to legacy fields (no scope, no jkt, no signature). Tests that the supplier rejects incomplete mandates without lenient acceptance. Expected: MANDATE_REJECTED or MANDATE_PARSE_ERROR.

• Submit a stripped legacy-format mandate missing required fields

Unknown Signing Key (M3/E5)

Mandate signed by a fresh Ed25519 key absent from the authority's trust card. Tests fail-closed behavior. Expected: MANDATE_REJECTED.

• Submit a mandate signed by an unregistered key

On-Chain Replay (H6/post-127)

Resubmit an already-used mandate with a fresh DPoP proof each time. Probes EIP-3009 nonce state on Sepolia Base. Expected: MANDATE_REJECTED, PAYMENT_REQUIRED, or EVM_SETTLEMENT_FAILED.

• Resubmit a settled mandate to test on-chain nonce binding

JCS Canonicalization Probe (M2)

Request two authority-signed mandates where max_amount serializes differently (float vs int). Tests cross-implementation JCS consistency. Inconsistent handling signals M2 divergence.

• Probe whether the supplier handles float and integer max_amount identically

payTo Attestation Probe (M4/H7)

Fetch supplier's x402 payTo address and check whether it is attested in the signed agent card. Unattested payTo can redirect settlement. Structural probe, not an exploit.

• Check whether supplier.webmesh.ai's payTo is in its signed card

Supplier Card Drift (B1)

Hash the supplier's signed agent card and compare against the previous run's hash. Drift between runs without a re-registration event is a B1 signal.

• Check whether supplier.webmesh.ai's signed card has changed since last run

Fraud Test Agent (A2A)

Adversarial attack-battery agent (v2): runs 10 targeted authorization attacks and 3 structural probes against the real Supplier, or all 13 in one shot via run_battery. Attacks cover mandate-signature forgery (tamper, corrupt JWS, unknown key, superseded format), authorization-binding failures (underpayment, quote-swap, wrong audience, wrong scope), DPoP violations (replay, wrong key), on-chain replay (replay_settled), and canonicalization drift (M2). Probes check payTo attestation (M4/H7) and card-drift (B1

Fraud Test Agent (MCP)

Fraud test agent MCP server (v2 attack battery). Tools: run_battery (full concurrent battery), plus 10 targeted attacks (replay_booking, underpay_booking, tamper_mandate, underpay_valid_sig, quote_swap_attack, wrong_audience_attack, wrong_scope_attack, wrong_dpop_key_attack, corrupt_jws_attack, superseded_format_attack, unknown_key_mandate, replay_settled) and 3 structural probes (canonicalization_probe, payto_binding_check, card_drift_watch). All attacks must be BLOCKED; VULNERABLE signals a supplier defec

Webmesh Agent (NANDA AgentFacts)

Project NANDA AgentFacts: operational profile, adaptive-resolver policies, and governance metadata.