CBubbleSurfaceDemo← Back to Home
Demo setup

Live systems connected
for this test

We connect real security systems to create a live environment. BubbleSurface derives the current capabilities and exposes them to the external agent through WebMCP.

Elastic / SIEM

Connected

Provides security evidence

  • ✓Login events
  • ✓MFA anomalies
  • ✓Privilege changes
  • ✓Activity timeline

Auth0

Connected

Provides identity state and actions

  • ✓Active sessions
  • ✓Current roles / privileges
  • ✓Identity context
  • ✓State verification target
C

BubbleSurface

Active

Derives current capabilities based on live state, policies and human approval.

Server enforced

WebMCP Capability Surface

Tools discovered for the agent

  • inspect_incidentGet incident summary and severity
  • get_active_sessionsList active identity sessions
  • get_device_contextRetrieve device and location context
  • check_privilege_changesCheck recent role / privilege changes
  • review_evidence_timelineView event timeline and evidence

What this enables

Real evidence

Elastic provides real-time security events and activity for investigation.

Real identity state

Auth0 provides current identity, privileges and sessions that can be acted upon.

Dynamic capabilities

BubbleSurface exposes the right tools at the right moment, nothing more.

This is the starting state before any approval.

Only investigation capabilities are available. Sensitive actions will appear after human approval.

Next: Define test case →