APPENDIX H: RESUME PORTFOLIO BUILDING CAPSTONE PROJECTS

WHAT YOU WILL BE ABLE TO CLAIM AFTERWARDS You built a client and a small tool server that communicate with JSON-RPC messages over standard input and output, in the style of MCP. You implemented layered defenses against prompt injection: an allowlist, argument validation, an untrusted-data wrapper, an injection scanner with quarantine, and a human approval gate. You demonstrated the same attack succeeding without defenses and failing with them, using automated tests. You kept an audit log of every allowed, blocked, and suspicious event. Do not claim that the system is immune to prompt injection, because phrase scanning catches only the attacks you thought of, and no defense is perfect. SKILLS PRACTICED Understanding what MCP and tool standards are for, covered in Chapter 16 and Chapter 50. Designing the safety architecture in layers, covered in Chapter 36. Permissions and access control, covered in Chapter 37. Prompt injection and tool poisoning, covered in Chapter 38. MCP and supply-chain security, covered in Chapter 39. Lifecycle hooks and approval points, covered in Chapter 24. Logging for audit, covered in Chapter 29.