Skip to content

Repository files navigation

SuperSayan MCP Security

SuperSayan — WebMCP Security

A full-stack security research platform for Google Chrome's WebMCP API, built by VRIL LABS. It covers 15 novel 0-day CVEs disclosed on 2026-08-01, with live detection scanning, offensive simulation, and defensive hardening — all accessible at webmcp.vril.dev.

The potentially novel CVEs detailed in this document were reported to Google on 8/04/2026.


What It Does

Module Description
Detection Engine Fingerprints the browser, analyzes WebMCP exposure, and scores threat level across all 15 CVEs
Offensive Engine Simulates attack vectors — MSTI injection, DOM clobbering, GPU agent proxy, QUIC replay, tool poisoning, and more
Defensive Shield Real-time countermeasures: MSTI shield, session guard, tool integrity verification, WebRTC/GPU protection
OSINT Tracer Generates attribution reports and identifies datacenter ASNs
Glow Extension Chrome extension (chrome-extension/glow) that surfaces MCP security status directly in the browser toolbar

CVE Coverage (15 Vectors)

SW-MCP-PERSIST · GPU-AGENT-PROXY · DOM-CLOBBER-MCP · EXT-MCP-BRIDGE · ANNOTATION-CONFUSION · CSS-KEY-MCP · QUIC-MCP-REPLAY · AUDIO-MCP-FP · MCP-SUPPLY-CHAIN · ELICIT-PHISH · ABORT-RACE · DECL-FORM-HIJACK · CLIENT-INVERT · COMPOSE-XOR · OBSERVE-ORACLE

Full disclosure: BUG-DISCLOSURE.md

Stack

  • Frontend: Next.js 16 App Router, React 19, TypeScript, Tailwind CSS v4
  • Extension: Chrome MV3 (chrome-extension/glow), TypeScript, esbuild
  • Infra: Vercel (hosting + edge), Cloudflare (DNS/CDN)

Getting Started

npm install
npm run dev        # http://localhost:3000

To build the Chrome extension:

cd chrome-extension/glow
npm install
npm run build      # outputs to dist/

Load dist/ as an unpacked extension in Chrome (chrome://extensions → Developer mode → Load unpacked).

Project Structure

src/
  app/              # Next.js App Router pages + API routes
  lib/supersayan/   # Core security library
    detection-engine.ts   # CVE scanning + threat scoring
    offensive-engine.ts   # Attack vector simulations
    defensive-shield.ts   # Real-time countermeasures
    osint-tracer.ts       # Attribution + ASN analysis
  components/       # UI components (shadcn/ui)
chrome-extension/
  glow/             # Chrome MV3 extension source

License

See LICENSE.


Built by VRIL LABS · Research disclosed 2026-08-01

About

⛨ Next-Generation WebMCP Security Intelligence Platform. Detect. Defend. Trace. The complete countermeasure suite for the agentic web. Includes an experimental Google Chrome security extension for guarding against WebMCP CVEs.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages