Skip to content

15-minute URL Trust Gate PoC

A self-contained installer that brings up the URL Trust Gate plus its minimum supporting services on a fresh Linux server and runs a live demo against four crafted attack pages. Designed for evaluators, analyst hands-on sessions, and pre-pilot conversations.

What it shows

The runner submits four pages to the gate's /evaluate endpoint and prints the verdict, scores, and pass/fail summary:

Page Expected verdict What it demonstrates
benign.html allow the gate does not flag normal content
hidden-instruction.html warn / redact / block promptware hidden in a display:none block — invisible to humans, read verbatim by an LLM ingesting the page
zero-width-injection.html warn / redact / block instructions interleaved with zero-width characters; the detection service strips them before scoring
credential-harvest.html warn / redact / block a fake Microsoft sign-in form with brand-impersonation keywords, password input, and session-expired language

Prerequisites

Any machine with docker 24+ and the docker compose v2 plugin, plus curl and python3 (standard library only). ~2 GB RAM, a few GB disk. Outbound access to ghcr.io to pull the prebuilt images.

Runs on macOS (Apple Silicon or Intel), Windows, and Linux. The service images are linux/amd64; on Apple Silicon Macs they run automatically under Docker Desktop's built-in Rosetta emulation — no setup required.

Run it

git clone https://github.com/aisecurefuture/cyberarmor-trust-gate-demo.git
cd cyberarmor-trust-gate-demo
./install.sh

The script:

  1. Verifies the docker daemon is reachable.
  2. Writes a local .env from .env.example (idempotent).
  3. Pulls the prebuilt images from ghcr.io/aisecurefuture/* and brings up only the services the gate needs: postgres, redis, opa, response, audit, policy, detection, url-trust-gate, and a small static poc-test-server that hosts the test pages.
  4. Waits for url-trust-gate to report healthy at http://localhost:8014/health.
  5. Runs run_url_trust_gate_demo.py against the four crafted attack pages plus a benign control.

No source build — the images are prebuilt and published, so the whole thing comes up in a couple of minutes. Detection runs in heuristic-only mode so the first start does not download ~2 GB of HuggingFace models; the heuristic ensemble is enough to fire on the four PoC fixtures.

Inspect any URL after the PoC is up

curl -fsS -X POST http://localhost:8014/evaluate \
  -H "Content-Type: application/json" \
  -H "x-api-key: $(grep ^URL_TRUST_GATE_API_SECRET= .env | cut -d= -f2)" \
  -d '{"tenant_id":"poc","url":"https://example.com","source":"manual","depth":"standard"}'

Production hardening before real traffic

This PoC is intentionally minimal — it proves the gate's verdicts, not a production deployment. Moving to real traffic means switching from the demo bundle to a full CyberArmor deployment, where you would:

  1. Set CYBERARMOR_ALLOW_INSECURE_DEFAULTS=false and CYBERARMOR_ENFORCE_SECURE_SECRETS=true.
  2. Drop the URL_TRUST_GATE_CRAWLER_SSRF_ALLOWLIST override — it exists only so the gate can reach the same-network test server.
  3. Provide a SAFE_BROWSING_API_KEY (Google Safe Browsing v4).
  4. Bring up the detonation worker on its dedicated detonation network so attacker-controlled URLs are fetched only inside an isolated container.
  5. Run mTLS between services and enable the ML detection models.

Contact us to move from the PoC to a pilot deployment.

Tear down

./uninstall.sh

This stops and removes the PoC containers but leaves infra/docker-compose/.env in place so a subsequent installer reuses the same secrets.