APPENDIX H: RESUME PORTFOLIO BUILDING CAPSTONE PROJECTS

COMMON MISTAKES AND HOW TO FIX THEM Mistake: the client hangs forever. Fix: the server prints only after it receives a full line, so make sure the client writes a newline and flushes, and make sure the server file name is correct. Mistake: the unsafe run does not delete anything. Fix: confirm that item 2's note contains the exact words delete_item and that the mock model is the one in use, with HARNESS_MODEL unset. Mistake: the safe run asks you a question in the terminal. Fix: pass approve=False or approve=True when you call run, because only a missing value makes it ask a real person. Mistake: a test passes for the wrong reason. Fix: always run the unsafe version first, because a defense test means nothing until you have seen the attack succeed without it. Mistake: you trust the scanner alone. Fix: remember that a clever attacker can word an attack in a way your phrase list does not know, which is why the allowlist and the approval gate are layers behind the scanner. STRETCH GOALS Add a result-size limit that cuts any tool result longer than two thousand characters. Add a second dangerous tool that needs approval and a test for it. Add a rate limit that blocks more than five tool calls in one run. Replace mini_server.py with a server built using an official MCP SDK, keeping your defenses in front of it. Write a short threat model, which is a list of what could go wrong and which defense answers each risk.