Hands-on lab environments for the Zenable Learning Hub.
Each directory under labs/ is a self-contained environment for one lab — the containers, scripts, and sample services a lab needs, so you can run the real thing on your own machine instead of reading about it.
We think information should be free. Companies are complex, and everyone's AI adoption journey is different. A rising tide lifts all ships, so we're committed to helping people learn this well enough to make good decisions, whether or not they ever use Zenable.
The Learning Hub runs each lab with per-section timing, progress tracking, and copy buttons on every command:
You can also clone this repository and follow a lab from here. Every lab directory carries the whole walkthrough in its README — the same content the Hub serves, generated from it.
git clone https://github.com/Zenable-io/labs.git ~/zenable-labs
cd ~/zenable-labs/labs/<lab>| Lab | What you'll do |
|---|---|
a2a |
Build two agents that discover and call each other over the A2A protocol, with Keycloak issuing every credential. Deep dives on agent cards and agent identity. |
acp-goose |
Speak the Agent Client Protocol to a real agent by hand, then watch the agent reach back for your filesystem and your shell, and put a policy on the wire that refuses it. |
agent-identity |
Bind an agent's access tokens to a key it holds (DPoP, RFC 9449) and give it a credential that reveals only what each verifier needs (SD-JWT, RFC 9901). Steal the tokens yourself and watch both hold. |
agentgateway-mcp |
Put a gateway between your agent and your MCP servers. Watch every tool call in access logs, metrics and traces, serve two servers from one endpoint, and refuse the calls you never wanted, all without touching a line of server code. |
ema-mcp |
Get hands-on with Enterprise-Managed Authorization (EMA) and the ID-JAG grant. Stand up a real MCP client, an enterprise IdP, and a vendor authorization server locally, watch an agent get authorized with no consent screen, then run an attack suite against the security properties that make it safe. |
mcp-get-started |
Learn what an MCP host, client, and server actually are. Write an MVP server with FastMCP, test it with a scripted client, move it into a container, connect goose to it without changing a line of server code, and hand it work to finish while you wait. |
These environments are built for learning, not production. They use demo credentials, self-signed trust, and deliberately weakened configurations so you can see what happens when things go wrong. Run them locally or on a throwaway VM, never somewhere that matters.
Please open an issue if you found something broken, unclear, or out of date. This repository is a generated mirror, so fixes land upstream and arrive here on the next sync.