A confused deputy attack, blocked by the gateway

This is the real code from the mcp-secure-gateway repository, running in your browser through Pyodide. An analyst is allowed to read documents and nothing else. Compare what an open proxy allows against what the gateway does instead. Every decision is recorded in the audit log below. The demo runs with no server and no keys.