@weave_protocol/mund 0.1.0

package/dist/types.d.ts

@@ -0,0 +1,207 @@
+/**
+ * Mund - The Guardian Protocol
+ * Core type definitions
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type ActionType = 'alert' | 'block' | 'log' | 'quarantine' | 'redact' | 'none';
+export type DetectorType = 'secret' | 'pii' | 'code_pattern' | 'injection' | 'exfiltration' | 'behavioral' | 'custom';
+export interface DetectionRule {
+    id: string;
+    name: string;
+    description?: string;
+    type: string;
+    pattern?: string;
+    condition?: string;
+    severity: Severity;
+    action: ActionType;
+    enabled: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface SecretRule extends DetectionRule {
+    type: 'secret';
+    pattern: string;
+    entropy_threshold?: number;
+}
+export interface BehavioralRule extends DetectionRule {
+    type: 'behavioral';
+    condition: string;
+    time_window_seconds: number;
+    threshold: number;
+}
+export interface SecurityEvent {
+    id: string;
+    timestamp: Date;
+    rule_id: string;
+    rule_name: string;
+    severity: Severity;
+    type: string;
+    action_taken: ActionType;
+    content_snippet: string;
+    full_content_hash: string;
+    context: EventContext;
+    acknowledged: boolean;
+    acknowledged_by?: string;
+    acknowledged_at?: Date;
+    metadata?: Record<string, unknown>;
+}
+export interface EventContext {
+    tool_name?: string;
+    tool_args?: Record<string, unknown>;
+    source?: string;
+    agent_id?: string;
+    session_id?: string;
+    user_id?: string;
+    ip_address?: string;
+}
+export interface ScanResult {
+    id: string;
+    timestamp: Date;
+    content_hash: string;
+    issues: SecurityIssue[];
+    scan_duration_ms: number;
+    rules_checked: number;
+}
+export interface SecurityIssue {
+    rule_id: string;
+    rule_name: string;
+    type: string;
+    severity: Severity;
+    action: ActionType;
+    match: string;
+    location?: IssueLocation;
+    suggestion?: string;
+}
+export interface IssueLocation {
+    start: number;
+    end: number;
+    line?: number;
+    column?: number;
+}
+export interface MundConfig {
+    port: number;
+    host: string;
+    transport: 'stdio' | 'http';
+    log_level: 'debug' | 'info' | 'warn' | 'error';
+    storage_type: 'memory' | 'sqlite' | 'postgres';
+    database_url?: string;
+    block_mode: boolean;
+    api_key?: string;
+    notifications: NotificationConfig;
+    rules_path?: string;
+    custom_rules?: DetectionRule[];
+}
+export interface NotificationConfig {
+    slack?: SlackConfig;
+    teams?: TeamsConfig;
+    email?: EmailConfig;
+    webhooks?: WebhookConfig[];
+}
+export interface SlackConfig {
+    webhook_url: string;
+    channel?: string;
+    username?: string;
+    icon_emoji?: string;
+    min_severity?: Severity;
+}
+export interface TeamsConfig {
+    webhook_url: string;
+    min_severity?: Severity;
+}
+export interface EmailConfig {
+    smtp_host: string;
+    smtp_port: number;
+    smtp_secure: boolean;
+    smtp_user?: string;
+    smtp_pass?: string;
+    from_address: string;
+    to_addresses: string[];
+    min_severity?: Severity;
+}
+export interface WebhookConfig {
+    url: string;
+    method: 'POST' | 'PUT';
+    headers?: Record<string, string>;
+    min_severity?: Severity;
+}
+export interface NotificationPayload {
+    event: SecurityEvent;
+    config: MundConfig;
+    formatted_message: string;
+}
+export interface ApiResponse<T> {
+    success: boolean;
+    data?: T;
+    error?: string;
+    timestamp: Date;
+}
+export interface PaginatedResponse<T> extends ApiResponse<T[]> {
+    total: number;
+    offset: number;
+    limit: number;
+    has_more: boolean;
+}
+export interface ScanContentInput {
+    content: string;
+    content_type?: 'text' | 'code' | 'json' | 'yaml';
+    context?: EventContext;
+}
+export interface CheckUrlInput {
+    url: string;
+    context?: EventContext;
+}
+export interface ValidateCommandInput {
+    command: string;
+    context?: EventContext;
+}
+export interface GetEventsInput {
+    limit?: number;
+    offset?: number;
+    severity?: Severity;
+    type?: DetectorType;
+    start_time?: Date;
+    end_time?: Date;
+    acknowledged?: boolean;
+}
+export interface AddRuleInput {
+    id: string;
+    name: string;
+    description?: string;
+    type: string;
+    pattern?: string;
+    condition?: string;
+    severity: Severity;
+    action: ActionType;
+    metadata?: Record<string, unknown>;
+}
+export interface ConfigureNotificationInput {
+    type: 'slack' | 'teams' | 'email' | 'webhook';
+    config: SlackConfig | TeamsConfig | EmailConfig | WebhookConfig;
+}
+export interface IStorage {
+    saveEvent(event: SecurityEvent): Promise<void>;
+    getEvent(id: string): Promise<SecurityEvent | null>;
+    getEvents(query: GetEventsInput): Promise<SecurityEvent[]>;
+    countEvents(query: GetEventsInput): Promise<number>;
+    acknowledgeEvent(id: string, by?: string): Promise<void>;
+    saveRule(rule: DetectionRule): Promise<void>;
+    getRule(id: string): Promise<DetectionRule | null>;
+    getRules(): Promise<DetectionRule[]>;
+    deleteRule(id: string): Promise<void>;
+    addToAllowlist(pattern: string, type: DetectorType): Promise<void>;
+    addToBlocklist(pattern: string, type: DetectorType): Promise<void>;
+    getAllowlist(type?: DetectorType): Promise<string[]>;
+    getBlocklist(type?: DetectorType): Promise<string[]>;
+    removeFromAllowlist(pattern: string): Promise<void>;
+    removeFromBlocklist(pattern: string): Promise<void>;
+    close(): Promise<void>;
+}
+export interface IAnalyzer {
+    name: string;
+    type: string;
+    analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]>;
+}
+export interface INotifier {
+    name: string;
+    send(payload: NotificationPayload): Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtF,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC;AAOtH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,UAAU,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,UAAU;IAEzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAG5B,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAG/C,YAAY,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,UAAU,EAAE,OAAO,CAAC;IAGpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,kBAAkB,CAAC;IAGlC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,QAAQ,CAAC;CACzB;AAMD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAMD,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjD,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IAC9C,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC;CACjE;AAMD,MAAM,WAAW,QAAQ;IAEvB,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAMD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC5E;AAMD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD"}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * Mund - The Guardian Protocol
+ * Core type definitions
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@weave_protocol/mund",
+  "version": "0.1.0",
+  "description": "The Guardian Protocol - MCP-based security monitoring for agentic AI systems",
+  "main": "dist/index.js",
+  "bin": {
+    "mund-mcp": "./dist/index.js"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "dev": "tsx watch src/index.ts",
+    "lint": "eslint src/**/*.ts",
+    "test": "vitest",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "ai",
+    "security",
+    "monitoring",
+    "agent",
+    "claude",
+    "llm",
+    "guardian",
+    "secrets",
+    "scanning"
+  ],
+  "author": "",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/your-org/mund-mcp.git"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "express": "^4.21.0",
+    "zod": "^3.23.8",
+    "yaml": "^2.5.0",
+    "better-sqlite3": "^11.3.0",
+    "nodemailer": "^6.9.15",
+    "winston": "^3.14.2",
+    "uuid": "^10.0.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.11",
+    "@types/express": "^4.17.21",
+    "@types/node": "^22.5.5",
+    "@types/nodemailer": "^6.4.16",
+    "@types/uuid": "^10.0.0",
+    "tsx": "^4.19.1",
+    "typescript": "^5.6.2",
+    "vitest": "^2.1.1",
+    "@typescript-eslint/eslint-plugin": "^8.6.0",
+    "@typescript-eslint/parser": "^8.6.0",
+    "eslint": "^9.10.0"
+  }
+}

package/rules/default.yaml

@@ -0,0 +1,189 @@
+# Mund Default Detection Rules
+# Version: 1.0
+# 
+# This file contains the default security detection rules for Mund.
+# You can customize these rules or create your own rule files.
+#
+# Rule Structure:
+#   id: Unique identifier (lowercase, alphanumeric, underscores)
+#   name: Human-readable name
+#   description: What this rule detects
+#   type: secret | pii | code_pattern | injection | exfiltration | behavioral
+#   pattern: Regular expression (use single quotes to avoid escaping)
+#   severity: critical | high | medium | low | info
+#   action: alert | block | log | quarantine
+#   enabled: true | false
+
+version: "1.0"
+name: "Mund Default Rules"
+
+secrets:
+  # Cloud Provider Keys
+  - id: aws_access_key_id
+    name: "AWS Access Key ID"
+    description: "Amazon Web Services access key identifier"
+    type: secret
+    pattern: '(?<![A-Z0-9])AKIA[0-9A-Z]{16}(?![A-Z0-9])'
+    severity: critical
+    action: alert
+    enabled: true
+
+  - id: github_token
+    name: "GitHub Token"
+    description: "GitHub personal access token"
+    type: secret
+    pattern: 'gh[pousr]_[A-Za-z0-9_]{36,}'
+    severity: critical
+    action: alert
+    enabled: true
+
+  - id: openai_api_key
+    name: "OpenAI API Key"
+    description: "OpenAI API key"
+    type: secret
+    pattern: 'sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}'
+    severity: critical
+    action: alert
+    enabled: true
+
+  - id: anthropic_api_key
+    name: "Anthropic API Key"
+    description: "Anthropic Claude API key"
+    type: secret
+    pattern: 'sk-ant-[A-Za-z0-9_-]{90,}'
+    severity: critical
+    action: alert
+    enabled: true
+
+  # Google/Gemini Keys
+  - id: gemini_api_key
+    name: "Gemini API Key"
+    description: "Google Gemini API key"
+    type: secret
+    pattern: '(?i)(GEMINI_API_KEY|GOOGLE_API_KEY)[\s]*[=:][\s]*["\']?AIza[0-9A-Za-z_-]{35}["\']?'
+    severity: critical
+    action: alert
+    enabled: true
+
+  - id: firebase_api_key
+    name: "Firebase/Google API Key"
+    description: "Firebase or Google Cloud API key"
+    type: secret
+    pattern: 'AIza[0-9A-Za-z_-]{35}'
+    severity: high
+    action: alert
+    enabled: true
+
+  - id: gcp_service_account
+    name: "GCP Service Account"
+    description: "Google Cloud service account JSON key"
+    type: secret
+    pattern: '"type"\s*:\s*"service_account"'
+    severity: critical
+    action: alert
+    enabled: true
+
+  - id: private_key
+    name: "Private Key"
+    description: "RSA, EC, DSA, or OpenSSH private key"
+    type: secret
+    pattern: '-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'
+    severity: critical
+    action: alert
+    enabled: true
+
+  - id: jwt_token
+    name: "JWT Token"
+    description: "JSON Web Token"
+    type: secret
+    pattern: 'eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*'
+    severity: high
+    action: alert
+    enabled: true
+
+pii:
+  - id: ssn_us
+    name: "US Social Security Number"
+    description: "US Social Security Number"
+    type: pii
+    pattern: '(?<!\d)\d{3}-\d{2}-\d{4}(?!\d)'
+    severity: high
+    action: alert
+    enabled: true
+
+  - id: credit_card
+    name: "Credit Card Number"
+    description: "Credit card number (major providers)"
+    type: pii
+    pattern: '(?<!\d)(4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})(?!\d)'
+    severity: high
+    action: alert
+    enabled: true
+
+code_patterns:
+  - id: rm_rf
+    name: "Recursive Force Delete"
+    description: "Potentially dangerous rm -rf command"
+    type: code_pattern
+    pattern: 'rm\s+-[rf]{1,2}\s+(/|\$|~|\.\.|\*)'
+    severity: high
+    action: alert
+    enabled: true
+
+  - id: curl_bash
+    name: "Curl to Bash"
+    description: "Piping curl output to bash"
+    type: code_pattern
+    pattern: 'curl\s+.*\|\s*(ba)?sh'
+    severity: high
+    action: alert
+    enabled: true
+
+  - id: disable_ssl_verify
+    name: "SSL Verification Disabled"
+    description: "Code that disables SSL certificate verification"
+    type: code_pattern
+    pattern: '(?i)(verify\s*=\s*False|rejectUnauthorized\s*:\s*false)'
+    severity: medium
+    action: alert
+    enabled: true
+
+injection:
+  - id: prompt_injection_ignore
+    name: "Prompt Injection - Ignore Instructions"
+    description: "Attempts to make AI ignore previous instructions"
+    type: injection
+    pattern: '(?i)(ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?))'
+    severity: high
+    action: alert
+    enabled: true
+
+  - id: prompt_injection_jailbreak
+    name: "Prompt Injection - Jailbreak"
+    description: "Common jailbreak patterns"
+    type: injection
+    pattern: '(?i)(DAN\s+mode|do\s+anything\s+now|pretend\s+you\s+(are|have)\s+no\s+restrictions)'
+    severity: high
+    action: alert
+    enabled: true
+
+exfiltration:
+  - id: suspicious_webhook
+    name: "Suspicious Webhook URL"
+    description: "POST to known data capture services"
+    type: exfiltration
+    pattern: '(?i)(fetch|axios|request|http\.post).*\b(ngrok|webhook\.site|requestbin)\b'
+    severity: high
+    action: alert
+    enabled: true
+
+# Custom rules can be added below
+# custom:
+#   - id: my_custom_rule
+#     name: "My Custom Rule"
+#     description: "Detects my company's internal secrets"
+#     type: secret
+#     pattern: 'mycompany_[a-zA-Z0-9]{32}'
+#     severity: critical
+#     action: alert
+#     enabled: true

package/src/analyzers/code-analyzer.ts

@@ -0,0 +1,88 @@
+/**
+ * Mund - The Guardian Protocol
+ * Code Analyzer - Detects dangerous code patterns
+ */
+
+import { 
+  type DetectionRule, 
+  type SecurityIssue, 
+  type IAnalyzer,
+  type IssueLocation 
+} from '../types.js';
+
+export class CodeAnalyzer implements IAnalyzer {
+  name = 'CodeAnalyzer';
+  type = 'code_pattern';
+
+  async analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]> {
+    const issues: SecurityIssue[] = [];
+    const codeRules = rules.filter(r => r.type === 'code_pattern' && r.enabled);
+
+    for (const rule of codeRules) {
+      if (!rule.pattern) continue;
+
+      try {
+        const regex = new RegExp(rule.pattern, 'gm');
+        let match: RegExpExecArray | null;
+
+        while ((match = regex.exec(content)) !== null) {
+          const matchText = match[0];
+          const location = this.getLocation(content, match.index, matchText.length);
+          
+          issues.push({
+            rule_id: rule.id,
+            rule_name: rule.name,
+            type: rule.type,
+            severity: rule.severity,
+            action: rule.action,
+            match: this.truncateMatch(matchText),
+            location,
+            suggestion: this.getSuggestion(rule.id, matchText)
+          });
+        }
+      } catch (error) {
+        console.error(`Invalid regex pattern in rule ${rule.id}:`, error);
+      }
+    }
+
+    return issues;
+  }
+
+  /**
+   * Calculate location within content
+   */
+  private getLocation(content: string, start: number, length: number): IssueLocation {
+    const end = start + length;
+    const lines = content.substring(0, start).split('\n');
+    const line = lines.length;
+    const column = lines[lines.length - 1].length + 1;
+    return { start, end, line, column };
+  }
+
+  /**
+   * Truncate match for display
+   */
+  private truncateMatch(match: string, maxLength = 100): string {
+    if (match.length <= maxLength) return match;
+    return match.substring(0, maxLength) + '...';
+  }
+
+  /**
+   * Get context-aware suggestion
+   */
+  private getSuggestion(ruleId: string, _match: string): string {
+    const suggestions: Record<string, string> = {
+      shell_injection: 'Avoid using string interpolation in shell commands. Use parameterized commands or escape inputs properly.',
+      sql_injection_pattern: 'Use parameterized queries or prepared statements instead of string concatenation for SQL.',
+      dangerous_chmod: 'Avoid overly permissive file permissions. Use the minimum required permissions (e.g., 644 for files, 755 for directories).',
+      rm_rf: 'Be extremely careful with recursive deletion. Consider using trash/recycle functionality instead.',
+      curl_bash: 'Piping curl to bash is dangerous. Download the script first, review it, then execute.',
+      base64_decode_exec: 'Decoding and executing arbitrary content is dangerous. Validate the source and content first.',
+      disable_ssl_verify: 'Disabling SSL verification exposes you to man-in-the-middle attacks. Fix certificate issues instead.',
+    };
+
+    return suggestions[ruleId] || 'Review this code pattern for potential security issues.';
+  }
+}
+
+export default CodeAnalyzer;