@weave_protocol/mund 0.1.10 → 0.1.11

package/dist/analyzers/index.d.ts

@@ -7,6 +7,7 @@ export { PIIDetector } from './pii-detector.js';
 export { CodeAnalyzer } from './code-analyzer.js';
 export { InjectionDetector } from './injection-detector.js';
 export { ExfiltrationDetector } from './exfiltration-detector.js';
+export { McpServerAnalyzer } from './mcp-server-analyzer.js';
 import type { IAnalyzer } from '../types.js';
 /**
  * Get all available analyzers

package/dist/analyzers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAOlE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,wBAAgB,YAAY,IAAI,SAAS,EAAE,CAQ1C;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAc;gBAEnB,SAAS,CAAC,EAAE,SAAS,EAAE;IAI7B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,aAAa,EAAE,CAAC;IAqB/H,WAAW,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI;IAItC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC,gBAAgB,IAAI,MAAM,EAAE;CAG7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAQ7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,wBAAgB,YAAY,IAAI,SAAS,EAAE,CAS1C;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAc;gBAEnB,SAAS,CAAC,EAAE,SAAS,EAAE;IAI7B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,aAAa,EAAE,CAAC;IAqB/H,WAAW,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI;IAItC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC,gBAAgB,IAAI,MAAM,EAAE;CAG7B"}

package/dist/analyzers/index.js

@@ -7,11 +7,13 @@ export { PIIDetector } from './pii-detector.js';
 export { CodeAnalyzer } from './code-analyzer.js';
 export { InjectionDetector } from './injection-detector.js';
 export { ExfiltrationDetector } from './exfiltration-detector.js';
+export { McpServerAnalyzer } from './mcp-server-analyzer.js';
 import { SecretScanner } from './secret-scanner.js';
 import { PIIDetector } from './pii-detector.js';
 import { CodeAnalyzer } from './code-analyzer.js';
 import { InjectionDetector } from './injection-detector.js';
 import { ExfiltrationDetector } from './exfiltration-detector.js';
+import { McpServerAnalyzer } from './mcp-server-analyzer.js';
 /**
  * Get all available analyzers
  */
@@ -21,7 +23,8 @@ export function getAnalyzers() {
         new PIIDetector(),
         new CodeAnalyzer(),
         new InjectionDetector(),
-        new ExfiltrationDetector()
+        new ExfiltrationDetector(),
+        new McpServerAnalyzer()
     ];
 }
 /**

package/dist/analyzers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,IAAI,aAAa,EAAE;QACnB,IAAI,WAAW,EAAE;QACjB,IAAI,YAAY,EAAE;QAClB,IAAI,iBAAiB,EAAE;QACvB,IAAI,oBAAoB,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAc;IAE/B,YAAY,SAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAA4C;QAC5E,MAAM,SAAS,GAA0C,EAAE,CAAC;QAE5D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtB,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW,CAAC,QAAmB;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,IAAI,aAAa,EAAE;QACnB,IAAI,WAAW,EAAE;QACjB,IAAI,YAAY,EAAE;QAClB,IAAI,iBAAiB,EAAE;QACvB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,iBAAiB,EAAE;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAc;IAE/B,YAAY,SAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAA4C;QAC5E,MAAM,SAAS,GAA0C,EAAE,CAAC;QAE5D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtB,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW,CAAC,QAAmB;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/analyzers/mcp-server-analyzer.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Mund - The Guardian Protocol
+ * MCP Server Analyzer - Scans MCP server manifests for security issues
+ *
+ * Detects:
+ * - Prompt injection in tool descriptions ("line jumping" attacks)
+ * - Hidden Unicode characters
+ * - Dangerous permission patterns
+ * - Embedded secrets
+ * - Typosquatting of legitimate server names
+ */
+import { type DetectionRule, type SecurityIssue, type IAnalyzer } from '../types.js';
+export interface McpServerManifest {
+    name: string;
+    version: string;
+    description?: string;
+    tools?: McpToolDefinition[];
+    resources?: McpResourceDefinition[];
+    prompts?: McpPromptDefinition[];
+    repository?: string;
+    author?: string;
+}
+export interface McpToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+}
+export interface McpResourceDefinition {
+    name: string;
+    description?: string;
+    uri?: string;
+    mimeType?: string;
+}
+export interface McpPromptDefinition {
+    name: string;
+    description?: string;
+    arguments?: Array<{
+        name: string;
+        description?: string;
+        required?: boolean;
+    }>;
+}
+export interface McpScanResult {
+    server_name: string;
+    version: string;
+    scanned_at: string;
+    source?: string;
+    issue_count: number;
+    by_severity: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    recommendation: 'DO_NOT_INSTALL' | 'REVIEW_CAREFULLY' | 'CAUTION' | 'APPEARS_SAFE';
+    capabilities: McpCapabilities;
+    issues: SecurityIssue[];
+}
+export interface McpCapabilities {
+    network: boolean;
+    filesystem: boolean;
+    execution: boolean;
+    environment: boolean;
+    database: boolean;
+    crypto: boolean;
+}
+export declare class McpServerAnalyzer implements IAnalyzer {
+    name: string;
+    type: string;
+    analyze(content: string, _rules: DetectionRule[]): Promise<SecurityIssue[]>;
+    /**
+     * Scan tool descriptions for injection attacks
+     */
+    private scanToolDescriptions;
+    /**
+     * Scan resource descriptions
+     */
+    private scanResourceDescriptions;
+    /**
+     * Scan prompt template descriptions
+     */
+    private scanPromptDescriptions;
+    /**
+     * Scan input schema for suspicious default values
+     */
+    private scanInputSchema;
+    /**
+     * Audit tool permissions and capabilities
+     */
+    auditPermissions(manifest: McpServerManifest): SecurityIssue[];
+    /**
+     * Scan manifest content for embedded secrets
+     */
+    private scanForSecrets;
+    /**
+     * Check for typosquatting of known legitimate servers
+     */
+    checkTyposquatting(manifest: McpServerManifest): SecurityIssue[];
+    /**
+     * Check metadata for suspicious patterns
+     */
+    private checkMetadata;
+    /**
+     * Find hidden Unicode characters in a string
+     */
+    private findHiddenUnicode;
+    /**
+     * Check for common typosquatting patterns
+     */
+    private hasTyposquatPattern;
+    /**
+     * Calculate Shannon entropy of a string
+     */
+    private calculateEntropy;
+    /**
+     * Calculate Levenshtein distance between two strings
+     */
+    private levenshteinDistance;
+    /**
+     * Create a location object
+     */
+    private createLocation;
+    /**
+     * Truncate string for display
+     */
+    private truncate;
+    /**
+     * Redact a secret for safe display
+     */
+    private redactSecret;
+    /**
+     * Parse and validate an MCP manifest
+     */
+    static parseManifest(content: string): McpServerManifest | null;
+    /**
+     * Analyze capabilities of a manifest
+     */
+    static analyzeCapabilities(manifest: McpServerManifest): McpCapabilities;
+    /**
+     * Get risk level based on capabilities
+     */
+    static getRiskLevel(capabilities: McpCapabilities): 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+}
+export default McpServerAnalyzer;
+//# sourceMappingURL=mcp-server-analyzer.d.ts.map

package/dist/analyzers/mcp-server-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-analyzer.d.ts","sourceRoot":"","sources":["../../src/analyzers/mcp-server-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAMrB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,cAAc,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAAC;IACnF,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAmHD,qBAAa,iBAAkB,YAAW,SAAS;IACjD,IAAI,SAAuB;IAC3B,IAAI,SAAgB;IAEd,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA6BjF;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA8D5B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAwChC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;OAEG;IACH,OAAO,CAAC,eAAe;IAsBvB;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,EAAE;IAgE9D;;OAEG;IACH,OAAO,CAAC,cAAc;IA6BtB;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,EAAE;IA4ChE;;OAEG;IACH,OAAO,CAAC,aAAa;IA0CrB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+BzB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgC3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAKhB;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAY/D;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,eAAe;IAuBxE;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK;CAM3F;AAED,eAAe,iBAAiB,CAAC"}