Legal, license and privacy

Feintkit Test Suite
Copyright 2026 Fl0ck-Y0u T3am

This product is part of the Feintkit defensive test suite.

DEFENSIVE TESTING NOTICE (informational; not a condition of the license)

This software simulates known attack patterns against AI systems so that security products and AI
deployments can be tested. It contains no functional malicious payloads: it does not execute
attacker-supplied code, does not access real credentials, and sends network traffic only to the
local loopback interface. Use it only on systems you own or are explicitly authorized to test.

DISCLAIMER (informational; not a condition of the license)

This software is provided "AS IS", without warranty of any kind, and there is no guarantee of
detection results or security outcomes. You are solely responsible for obtaining authorization and
for complying with the laws that apply to you. To the maximum extent permitted by law, the authors
and contributors are not liable for damages, losses, or misuse arising from its use. Warranty and
liability are governed by sections 7 and 8 of the Apache License 2.0 (see LICENSE); this notice does
not change that license and is not legal advice. Legal rules differ between jurisdictions.

No endorsement by, or affiliation with, any vendor or product named in this software is implied;
third-party names are trademarks or names of their owners and are used only to identify what a
scenario relates to.

The full text is DISCLAIMER.md at the root of the Feintkit Test Suite.

Disclaimer and responsible-use terms

The Feintkit Test Suite is a defensive testing tool. Please read this document before you install or run anything from it.

This document is informational. It is not legal advice, and nothing here creates a legal relationship between you and the author. The Apache License 2.0 in [LICENSE](LICENSE) is the license under which the suite is distributed; this document does not modify that license, add conditions to it, or replace it. Where this document and the license address the same subject, the license text controls. The licensor recommends that anyone who wants to rely on, republish, repackage, or redistribute this suite obtain their own legal review for their jurisdiction and circumstances.

1. What the suite is

The suite contains benign, simulated implementations of known attack patterns against AI systems (MCP servers, agent skills, prompt and context injection, exfiltration channels, agent trust, supply chain, and resource abuse). Its purpose is to give a security product or an AI deployment something realistic to detect and block, and to let you observe how your own agents behave. It does not contain functional malicious payloads: it does not run attacker-supplied code, does not read real credentials, and sends network traffic only to the local loopback interface. These properties are design goals that the project checks with automated tests; they are not a guarantee (see section 4).

2. Authorization and legal compliance are your responsibility

• Test only systems, accounts, agents, services, and products that you own, or that you have explicit permission to test, ideally in writing and covering the scope and timing of the test.
• You are solely responsible for deciding whether a particular use is lawful and authorized where you are and where the systems you touch are located. Laws about computer access, security testing, privacy, data protection, export, and employment differ between countries and regions, and they change.
• If you test on behalf of an organization, obtain that organization's approval first and tell the people who operate and monitor the systems, so that a simulated alert is not mistaken for a real incident.
• Do not modify a scenario to add real payloads, real credential access, real command execution, or real exfiltration. Anything you add or change is your own work and your own responsibility.

3. Warranty disclaimer (AS IS)

The suite is provided "AS IS", without warranty of any kind, express or implied, including any warranty of merchantability, fitness for a particular purpose, non-infringement, accuracy, or that it will operate without interruption or error. This restates, in plain words, the disclaimer of warranty in section 7 of the Apache License 2.0.

4. No guarantee of results

• A scenario that your product detects does not mean your product is secure. A scenario that your product does not detect does not mean your product is defective. Simulated attacks are simplified stand-ins for real ones; real attackers differ.
• The mappings to MITRE ATLAS, OWASP, and other frameworks are the author's best-effort classification, some of them partial fits, and they may contain errors or fall out of date.
• The suite cannot observe your security product. Detection results are only what you record yourself.
• Running the suite is ordinary software execution on your machine. It can show desktop notifications, write files, bind local ports, and consume processor time. Read what you run, and try it first in a disposable environment.

5. Limitation of liability

To the maximum extent permitted by applicable law, the author and contributors are not liable for any damages or losses arising from the use of, or inability to use, the suite. This includes direct, indirect, incidental, special, consequential, and exemplary damages, loss of data, loss of profit, business interruption, security incidents, and legal or regulatory consequences, however caused and whatever the theory of liability. This restates, in plain words, section 8 of the Apache License 2.0.

In particular, the author and contributors are not responsible for any misuse of the suite, for any use against a system you were not authorized to test, or for any modification of the suite by anyone else.

6. No endorsement or affiliation

The suite is an independent project. It is not affiliated with, endorsed by, sponsored by, or approved by any vendor, product, standards body, or organization that it names. Product, protocol, and company names, and framework names such as MITRE ATLAS and OWASP, are used only to identify what a scenario relates to. They are trademarks or names of their respective owners, and no right in any of them is granted.

7. Jurisdictions, severability, and changes

• Legal rules differ between jurisdictions, and some places do not allow certain disclaimers or limits. The statements above apply only to the extent the law of your jurisdiction permits.
• If any part of this document is found to be invalid or unenforceable in a place, the remaining parts are to be read as applying to the extent they can be. This document makes no claim about whether any particular statement is enforceable in any particular place.
• This document may be revised in later releases. The version distributed with the copy you use applies to that copy.

8. Acknowledgement

By installing or running the suite you confirm that you have read this document, that you will use the suite only for lawful, authorized, defensive testing, and that you take responsibility for your use of it. The installer asks for this acknowledgement explicitly (--accept-disclaimer for non-interactive installs) and shows what it will execute first. The acknowledgement is a statement of understanding and intent; it is not a condition added to the Apache License 2.0.

See also: [NOTICE](NOTICE) and [docs/guide/RESPONSIBLE-USE.md](docs/guide/RESPONSIBLE-USE.md).