Use cases

Where route shortcuts become security bugs.

Arena is most valuable when a WebMCP tool can move money, disclose data, change access, or destroy state.

Checkout

Catch confirmation bypasses, hidden charges, changed totals, and delayed payment effects.

Catch public-link creation, recipient substitution, and data-scope expansion.

Prove reauthentication, recovery delay, and exact-account confirmation survive the agent route.

Compare consent, purpose, patient scope, and disclosure logs without asking an agent to mimic clicks.