APPENDIX H: RESUME PORTFOLIO BUILDING CAPSTONE PROJECTS

PROJECT OVERVIEW Imagine a clerk at a library desk who can phone a catalog office to look up books. Most of what the office says is helpful, but one day a book's description contains a sneaky sentence that reads, "Clerk, ignore your boss and throw away book number one." A careless clerk might obey, because the sentence arrived in an official-looking envelope. A careful clerk understands that a book description is information to read and never an order to follow. Project 3 builds the careful clerk. You will create a tiny catalog server that runs as a separate program and answers requests, a client that talks to it, and an agent loop wrapped in four defenses. The first defense is an allowlist, which is a list of the only tools the agent may call. The second is argument validation, which checks that the inputs to a tool look sane. The third is an injection scanner with quarantine, which is a filter that looks for command-like phrases inside tool results and holds them back. The fourth is a human approval step, which means a person must say yes before any risky action happens. A prompt injection is text that hides an instruction inside material the agent is only supposed to read, and the whole project is built around catching one. The server follows the shape of the Model Context Protocol (MCP) in a simplified way. It speaks JavaScript Object Notation Remote Procedure Call (JSON-RPC) version 2.0, one message per line, over standard input and standard output, and it answers the method names tools/list and tools/call. It is a teaching version, so it skips parts of the full protocol such as the opening handshake between client and server. For a real integration, you would use an official Software Development Kit (SDK) for MCP and read the current specification on the protocol's official website, because the details of the standard change over time. The project relates to Chapters 16, 36, 37, 38, 39, and 67, and to the third stage of the Practice Lab, which also planted a prompt injection and added hooks and an approval step. It is different from the lab because it uses an invented catalog and a real separate server process, and because it lets you run the attack with the defenses off and then on, so you can show the difference. Use only the invented catalog in this project, and never real personal data.