Operation Silent Night: The Only Way In Is Proving Your Device

Something’s been hiding in plain sight.

This holiday season, Smallstep is launching our annual Holiday Project as Operation Silent Night: an alternate-reality puzzle hunt with 24 days, three acts and one vault. Players act as incident responders, racing to recover scattered secret shards, unmask a forged device identity and re-seal the vault before the holiday finale.

There’s a catch. Every move happens through our MCP gateway, and the gateway only lets in devices that can prove who they are with hardware attestation. Software keys and copied identifiers won’t get you past the door.

That’s not a gimmick. It’s the point.

As AI tools connect to more of the systems we rely on, a growing question is how you know which device, and which tool, is really on the other end of a request. Operation Silent Night puts that question in players’ hands.

Join us on Tuesday, December 15th where we’ll introduce Operation Silent Night and show how we built a holiday contest around one of the hardest problems in security right now.

We’ll cover:

• How Operation Silent Night works, and how to join the operation
• Why every player starts by enrolling a hardware-attested device, and what that enrollment teaches
• How an MCP gateway uses device identity to decide who gets in, on every tool call
• Why one attested device means one player, so solutions can’t simply be copied and shared
• Why a copied credential is an impostor’s favorite tool, and how attestation catches it (no spoilers, we promise)

We’ll also walk through a live demo, enrolling a device and making a first attested call to the contest’s MCP server, so you can see exactly what stands between a forged identity and the vault.