@weave_protocol/mund 0.2.3 → 0.3.1

package/dist/analyzers/secret-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-scanner.js","sourceRoot":"","sources":["../../src/analyzers/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,OAAO,aAAa;IACxB,IAAI,GAAG,eAAe,CAAC;IACvB,IAAI,GAAG,QAAQ,CAAC;IAEhB,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,KAAsB;QACnD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAExE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAE5B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC5C,IAAI,KAA6B,CAAC;gBAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;oBAE1E,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,SAAS,EAAE,IAAI,CAAC,IAAI;wBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;wBACnC,QAAQ;wBACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yCAAyC;gBACzC,OAAO,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;QAE3B,4BAA4B;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAElD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc;QACjC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,GAAG,YAAY,GAAG,UAAU,CAAC;QAEjE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAC1I,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc;QAClC,MAAM,WAAW,GAA2B;YAC1C,iBAAiB,EAAE,+EAA+E;YAClG,qBAAqB,EAAE,iFAAiF;YACxG,YAAY,EAAE,iEAAiE;YAC/E,yBAAyB,EAAE,wDAAwD;YACnF,cAAc,EAAE,mEAAmE;YACnF,iBAAiB,EAAE,sEAAsE;YACzF,cAAc,EAAE,+EAA+E;YAC/F,WAAW,EAAE,mEAAmE;YAChF,aAAa,EAAE,yDAAyD;YACxE,cAAc,EAAE,wEAAwE;YACxF,iBAAiB,EAAE,qEAAqE;YACxF,SAAS,EAAE,yEAAyE;YACpF,YAAY,EAAE,+EAA+E;YAC7F,eAAe,EAAE,0EAA0E;YAC3F,gBAAgB,EAAE,6DAA6D;SAChF,CAAC;QAEF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,kFAAkF,CAAC;IACnH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,GAAW;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACvB,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAExB,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW,EAAE,SAAS,GAAG,GAAG;QAC/C,8CAA8C;QAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAEtD,8CAA8C;QAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5D,OAAO,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACzD,CAAC;CACF;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"secret-scanner.js","sourceRoot":"","sources":["../../src/analyzers/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,OAAO,aAAa;IACxB,IAAI,GAAG,eAAe,CAAC;IACvB,IAAI,GAAG,QAAQ,CAAC;IAEhB,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,KAAsB;QACnD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAExE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAE5B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACpD,IAAI,KAA6B,CAAC;gBAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;oBAE1E,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,SAAS,EAAE,IAAI,CAAC,IAAI;wBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;wBACnC,QAAQ;wBACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yCAAyC;gBACzC,OAAO,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;QAE3B,4BAA4B;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAElD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc;QACjC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,GAAG,YAAY,GAAG,UAAU,CAAC;QAEjE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAC1I,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc;QAClC,MAAM,WAAW,GAA2B;YAC1C,iBAAiB,EAAE,+EAA+E;YAClG,qBAAqB,EAAE,iFAAiF;YACxG,YAAY,EAAE,iEAAiE;YAC/E,yBAAyB,EAAE,wDAAwD;YACnF,cAAc,EAAE,mEAAmE;YACnF,iBAAiB,EAAE,sEAAsE;YACzF,cAAc,EAAE,+EAA+E;YAC/F,WAAW,EAAE,mEAAmE;YAChF,aAAa,EAAE,yDAAyD;YACxE,cAAc,EAAE,wEAAwE;YACxF,iBAAiB,EAAE,qEAAqE;YACxF,SAAS,EAAE,yEAAyE;YACpF,YAAY,EAAE,+EAA+E;YAC7F,eAAe,EAAE,0EAA0E;YAC3F,gBAAgB,EAAE,6DAA6D;SAChF,CAAC;QAEF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,kFAAkF,CAAC;IACnH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,GAAW;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACvB,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAExB,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW,EAAE,SAAS,GAAG,GAAG;QAC/C,8CAA8C;QAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAEtD,8CAA8C;QAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5D,OAAO,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACzD,CAAC;CACF;AAED,eAAe,aAAa,CAAC"}

package/dist/canary.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary Tokens - detect system prompt leakage (OWASP LLM07)
+ *
+ * Generate a unique marker, place it in your system prompt (or any
+ * confidential context), and Mund flags any scanned output that
+ * contains it. A model that has been talked into revealing its
+ * instructions reveals the canary with them.
+ *
+ * Matching tolerates the cheap evasions a leaking model or an attacker
+ * might apply: case changes, inserted whitespace / zero-width
+ * characters / punctuation, base64 encoding, and reversal.
+ */
+import type { DetectionRule, IAnalyzer, SecurityIssue } from './types.js';
+export interface Canary {
+    token: string;
+    label: string;
+    createdAt: string;
+}
+export type CanaryMatchKind = 'exact' | 'obfuscated' | 'base64' | 'reversed';
+export declare class CanaryRegistry {
+    private canaries;
+    /** Create a new random canary token. */
+    create(label?: string): Canary;
+    /** Register an existing token (e.g. one already deployed in a prompt). */
+    register(token: string, label?: string): Canary;
+    remove(token: string): boolean;
+    list(): Canary[];
+    get size(): number;
+    /** Find every registered canary that appears in the content. */
+    find(content: string): Array<{
+        canary: Canary;
+        kind: CanaryMatchKind;
+        index: number;
+    }>;
+}
+/** Shared registry used by the MCP tools and the default analyzer set. */
+export declare const canaries: CanaryRegistry;
+/** Load canaries from MUND_CANARIES (comma-separated) or MUND_CANARY_FILE (one per line). */
+export declare function loadCanariesFromEnv(registry?: CanaryRegistry): number;
+export declare class CanaryDetector implements IAnalyzer {
+    private registry;
+    name: string;
+    type: string;
+    constructor(registry?: CanaryRegistry);
+    analyze(content: string, _rules: DetectionRule[]): Promise<SecurityIssue[]>;
+}
+//# sourceMappingURL=canary.d.ts.map

package/dist/canary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.d.ts","sourceRoot":"","sources":["../src/canary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAW7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAA6B;IAE7C,wCAAwC;IACxC,MAAM,CAAC,KAAK,SAAkB,GAAG,MAAM;IAUvC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAkB,GAAG,MAAM;IASxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9B,IAAI,IAAI,MAAM,EAAE;IAIhB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,gEAAgE;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAwBvF;AAiBD,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,gBAAuB,CAAC;AAE7C,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,cAAyB,GAAG,MAAM,CAoB/E;AAED,qBAAa,cAAe,YAAW,SAAS;IAIlC,OAAO,CAAC,QAAQ;IAH5B,IAAI,SAAoB;IACxB,IAAI,SAAkB;gBAEF,QAAQ,GAAE,cAAyB;IAEjD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAmBlF"}

package/dist/canary.js

@@ -0,0 +1,149 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary Tokens - detect system prompt leakage (OWASP LLM07)
+ *
+ * Generate a unique marker, place it in your system prompt (or any
+ * confidential context), and Mund flags any scanned output that
+ * contains it. A model that has been talked into revealing its
+ * instructions reveals the canary with them.
+ *
+ * Matching tolerates the cheap evasions a leaking model or an attacker
+ * might apply: case changes, inserted whitespace / zero-width
+ * characters / punctuation, base64 encoding, and reversal.
+ */
+import { randomBytes } from 'crypto';
+import { readFileSync } from 'fs';
+const TOKEN_PREFIX = 'MUND-CANARY-';
+const MIN_TOKEN_LENGTH = 12;
+const ZERO_WIDTH = /[​-‍⁠]/g;
+/** Lowercase and keep only letters and digits. */
+function squash(text) {
+    return text.replace(ZERO_WIDTH, '').toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+export class CanaryRegistry {
+    canaries = new Map();
+    /** Create a new random canary token. */
+    create(label = 'system-prompt') {
+        const canary = {
+            token: TOKEN_PREFIX + randomBytes(8).toString('hex').toUpperCase(),
+            label,
+            createdAt: new Date().toISOString(),
+        };
+        this.canaries.set(canary.token, canary);
+        return canary;
+    }
+    /** Register an existing token (e.g. one already deployed in a prompt). */
+    register(token, label = 'system-prompt') {
+        if (squash(token).length < MIN_TOKEN_LENGTH) {
+            throw new Error(`Canary token must contain at least ${MIN_TOKEN_LENGTH} letters/digits to avoid false positives`);
+        }
+        const canary = { token, label, createdAt: new Date().toISOString() };
+        this.canaries.set(token, canary);
+        return canary;
+    }
+    remove(token) {
+        return this.canaries.delete(token);
+    }
+    list() {
+        return [...this.canaries.values()];
+    }
+    get size() {
+        return this.canaries.size;
+    }
+    /** Find every registered canary that appears in the content. */
+    find(content) {
+        const hits = [];
+        if (this.canaries.size === 0 || !content)
+            return hits;
+        const lower = content.toLowerCase();
+        const squashed = squash(content);
+        const decoded = decodeBase64Runs(content).map(squash);
+        for (const canary of this.canaries.values()) {
+            const needle = squash(canary.token);
+            const exactAt = lower.indexOf(canary.token.toLowerCase());
+            if (exactAt !== -1) {
+                hits.push({ canary, kind: 'exact', index: exactAt });
+            }
+            else if (squashed.includes(needle)) {
+                hits.push({ canary, kind: 'obfuscated', index: -1 });
+            }
+            else if (decoded.some(d => d.includes(needle))) {
+                hits.push({ canary, kind: 'base64', index: -1 });
+            }
+            else if (squashed.includes([...needle].reverse().join(''))) {
+                hits.push({ canary, kind: 'reversed', index: -1 });
+            }
+        }
+        return hits;
+    }
+}
+/** Decode every plausible base64 run in the text (best effort). */
+function decodeBase64Runs(content) {
+    const runs = content.match(/[A-Za-z0-9+/]{16,}={0,2}/g) ?? [];
+    const out = [];
+    for (const run of runs) {
+        try {
+            const text = Buffer.from(run, 'base64').toString('utf8');
+            if (/^[\x20-\x7E\s]+$/.test(text))
+                out.push(text);
+        }
+        catch {
+            // not base64
+        }
+    }
+    return out;
+}
+/** Shared registry used by the MCP tools and the default analyzer set. */
+export const canaries = new CanaryRegistry();
+/** Load canaries from MUND_CANARIES (comma-separated) or MUND_CANARY_FILE (one per line). */
+export function loadCanariesFromEnv(registry = canaries) {
+    const tokens = [];
+    if (process.env.MUND_CANARIES)
+        tokens.push(...process.env.MUND_CANARIES.split(','));
+    if (process.env.MUND_CANARY_FILE) {
+        try {
+            tokens.push(...readFileSync(process.env.MUND_CANARY_FILE, 'utf8').split('\n'));
+        }
+        catch {
+            // missing file: nothing to load
+        }
+    }
+    let loaded = 0;
+    for (const t of tokens.map(t => t.trim()).filter(Boolean)) {
+        try {
+            registry.register(t, 'env');
+            loaded++;
+        }
+        catch {
+            // too short; skip
+        }
+    }
+    return loaded;
+}
+export class CanaryDetector {
+    registry;
+    name = 'CanaryDetector';
+    type = 'exfiltration';
+    constructor(registry = canaries) {
+        this.registry = registry;
+    }
+    async analyze(content, _rules) {
+        return this.registry.find(content).map(({ canary, kind, index }) => {
+            const before = index >= 0 ? content.slice(0, index).split('\n') : null;
+            return {
+                rule_id: 'canary_leak',
+                rule_name: `Canary token leaked (${kind})`,
+                type: 'exfiltration',
+                severity: 'critical',
+                action: 'block',
+                match: `${canary.token.slice(0, TOKEN_PREFIX.length + 4)}…`,
+                ...(before
+                    ? { location: { start: index, end: index + canary.token.length, line: before.length, column: before[before.length - 1].length + 1 } }
+                    : {}),
+                suggestion: `Content contains the "${canary.label}" canary, so confidential instructions or context are leaking. ` +
+                    'Block this output and review the prompt that produced it.',
+            };
+        });
+    }
+}
+//# sourceMappingURL=canary.js.map

package/dist/canary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.js","sourceRoot":"","sources":["../src/canary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAWlC,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,kDAAkD;AAClD,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,wCAAwC;IACxC,MAAM,CAAC,KAAK,GAAG,eAAe;QAC5B,MAAM,MAAM,GAAW;YACrB,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YAClE,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,QAAQ,CAAC,KAAa,EAAE,KAAK,GAAG,eAAe;QAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sCAAsC,gBAAgB,0CAA0C,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,OAAe;QAClB,MAAM,IAAI,GAAoE,EAAE,CAAC;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEtD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAE1D,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,WAA2B,QAAQ;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,cAAc;IAIL;IAHpB,IAAI,GAAG,gBAAgB,CAAC;IACxB,IAAI,GAAG,cAAc,CAAC;IAEtB,YAAoB,WAA2B,QAAQ;QAAnC,aAAQ,GAAR,QAAQ,CAA2B;IAAG,CAAC;IAE3D,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,MAAuB;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACjE,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,SAAS,EAAE,wBAAwB,IAAI,GAAG;gBAC1C,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG;gBAC3D,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE;oBACrI,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EACR,yBAAyB,MAAM,CAAC,KAAK,iEAAiE;oBACtG,2DAA2D;aAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/cli/scan.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Mund - The Guardian Protocol
+ * `mund-mcp scan` - scan files on disk and report as text, JSON or SARIF
+ *
+ *   mund-mcp scan [paths...] [--format=text|json|sarif] [--output=FILE]
+ *                 [--fail-on=critical|high|medium|low|none]
+ *                 [--no-osv] [--offline]
+ */
+import type { Severity } from '../types.js';
+import { type RiskScore } from '../scoring.js';
+import { type SarifTarget } from '../sarif.js';
+import { OsvClient, type OsvSource } from '../osv.js';
+export type OutputFormat = 'text' | 'json' | 'sarif';
+type FailOn = Severity | 'none';
+export interface ScanCliOptions {
+    paths: string[];
+    format: OutputFormat;
+    output?: string;
+    failOn: FailOn;
+    osv: boolean;
+    offline: boolean;
+    canaries: string[];
+}
+export interface FileReport extends SarifTarget {
+    risk: RiskScore;
+}
+export interface ScanReport {
+    tool: {
+        name: 'mund';
+        version: string;
+    };
+    risk: RiskScore;
+    files_scanned: number;
+    osv?: {
+        source: OsvSource;
+        lockfiles: number;
+        unchecked: number;
+        error?: string;
+    };
+    files: FileReport[];
+}
+export declare const SCAN_USAGE = "Usage: mund-mcp scan [paths...] [options]\n\nScan files for secrets, PII, injection, exfiltration and dangerous code,\nplus known-vulnerable npm dependencies (via OSV.dev) in package-lock.json.\n\nOptions:\n  --format=FORMAT    text (default), json, or sarif\n  --output=FILE      Write the report to FILE instead of stdout\n  --fail-on=LEVEL    Exit 1 if any finding is at or above LEVEL\n                     (critical, high [default], medium, low, none)\n  --no-osv           Skip dependency vulnerability lookups\n  --offline          Use only the local OSV cache (also: MUND_OFFLINE=1)\n  --canary=TOKEN     Flag any file containing this canary token (repeatable;\n                     also MUND_CANARIES / MUND_CANARY_FILE)\n\nExamples:\n  mund-mcp scan .\n  mund-mcp scan src --format=sarif --output=mund.sarif\n";
+export declare function parseScanArgs(args: string[]): ScanCliOptions;
+export declare function runScan(opts: ScanCliOptions, osvClient?: OsvClient): Promise<ScanReport>;
+export declare function formatReport(report: ScanReport, format: OutputFormat): string;
+export declare function shouldFail(report: ScanReport, failOn: FailOn): boolean;
+/** Entry point for `mund-mcp scan`. Returns the process exit code. */
+export declare function runScanCli(args: string[]): Promise<number>;
+export {};
+//# sourceMappingURL=scan.d.ts.map

package/dist/cli/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAwC,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAI5F,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AACrD,KAAK,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAOD,eAAO,MAAM,UAAU,wzBAkBtB,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CA8C5D;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAuD9F;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAwB7E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAItE;AAED,sEAAsE;AACtE,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBhE"}

package/dist/cli/scan.js

@@ -0,0 +1,235 @@
+/**
+ * Mund - The Guardian Protocol
+ * `mund-mcp scan` - scan files on disk and report as text, JSON or SARIF
+ *
+ *   mund-mcp scan [paths...] [--format=text|json|sarif] [--output=FILE]
+ *                 [--fail-on=critical|high|medium|low|none]
+ *                 [--no-osv] [--offline]
+ */
+import { readFile, writeFile, readdir, stat } from 'fs/promises';
+import { basename, join, relative, resolve, sep } from 'path';
+import { DEFAULT_RULES } from '../constants.js';
+import { AnalyzerEngine } from '../analyzers/index.js';
+import { computeRiskScore } from '../scoring.js';
+import { toSarif } from '../sarif.js';
+import { OsvClient, parseNpmLockfile, advisoriesToIssues } from '../osv.js';
+import { getVersion } from '../version.js';
+import { canaries, loadCanariesFromEnv } from '../canary.js';
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.next', '.turbo', 'vendor', '__pycache__', '.venv']);
+const LOCKFILES = new Set(['package-lock.json', 'npm-shrinkwrap.json']);
+const MAX_FILE_BYTES = 1024 * 1024;
+const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+export const SCAN_USAGE = `Usage: mund-mcp scan [paths...] [options]
+
+Scan files for secrets, PII, injection, exfiltration and dangerous code,
+plus known-vulnerable npm dependencies (via OSV.dev) in package-lock.json.
+
+Options:
+  --format=FORMAT    text (default), json, or sarif
+  --output=FILE      Write the report to FILE instead of stdout
+  --fail-on=LEVEL    Exit 1 if any finding is at or above LEVEL
+                     (critical, high [default], medium, low, none)
+  --no-osv           Skip dependency vulnerability lookups
+  --offline          Use only the local OSV cache (also: MUND_OFFLINE=1)
+  --canary=TOKEN     Flag any file containing this canary token (repeatable;
+                     also MUND_CANARIES / MUND_CANARY_FILE)
+
+Examples:
+  mund-mcp scan .
+  mund-mcp scan src --format=sarif --output=mund.sarif
+`;
+export function parseScanArgs(args) {
+    const opts = { paths: [], format: 'text', failOn: 'high', osv: true, offline: false, canaries: [] };
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const [flag, inline] = arg.startsWith('--') && arg.includes('=') ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)] : [arg, undefined];
+        const value = () => {
+            const v = inline ?? args[++i];
+            if (v === undefined)
+                throw new Error(`${flag} needs a value`);
+            return v;
+        };
+        switch (flag) {
+            case '--format': {
+                const v = value();
+                if (v !== 'text' && v !== 'json' && v !== 'sarif')
+                    throw new Error(`Unknown format "${v}" (expected text, json or sarif)`);
+                opts.format = v;
+                break;
+            }
+            case '--output':
+            case '-o':
+                opts.output = value();
+                break;
+            case '--fail-on': {
+                const v = value();
+                if (v !== 'none' && !(v in SEVERITY_RANK))
+                    throw new Error(`Unknown --fail-on level "${v}"`);
+                opts.failOn = v;
+                break;
+            }
+            case '--no-osv':
+                opts.osv = false;
+                break;
+            case '--offline':
+                opts.offline = true;
+                break;
+            case '--canary':
+                opts.canaries.push(value());
+                break;
+            default:
+                if (flag.startsWith('-'))
+                    throw new Error(`Unknown option ${flag}`);
+                opts.paths.push(arg);
+        }
+    }
+    if (opts.paths.length === 0)
+        opts.paths.push('.');
+    return opts;
+}
+export async function runScan(opts, osvClient) {
+    const cwd = process.cwd();
+    loadCanariesFromEnv();
+    for (const token of opts.canaries)
+        canaries.register(token, 'cli');
+    const engine = new AnalyzerEngine();
+    const files = [];
+    const lockfiles = [];
+    let scanned = 0;
+    for (const file of await collectFiles(opts.paths.map(p => resolve(cwd, p)))) {
+        if (LOCKFILES.has(basename(file))) {
+            lockfiles.push(file);
+            continue;
+        }
+        const content = await readText(file);
+        if (content === null)
+            continue;
+        scanned++;
+        const issues = await engine.analyzeAll(content, DEFAULT_RULES);
+        if (issues.length > 0)
+            files.push({ uri: toUri(cwd, file), issues, risk: computeRiskScore(issues) });
+    }
+    let osv;
+    if (opts.osv && lockfiles.length > 0) {
+        const client = osvClient ?? new OsvClient({ offline: opts.offline });
+        let source = 'live';
+        let unchecked = 0;
+        let error;
+        for (const lockfile of lockfiles) {
+            const content = await readFile(lockfile, 'utf8');
+            let packages;
+            try {
+                packages = parseNpmLockfile(content);
+            }
+            catch {
+                continue; // malformed lockfile; nothing to look up
+            }
+            const result = await client.lookup(packages);
+            // Report the weakest source across lockfiles.
+            if (result.source === 'unavailable' || (result.source === 'cache' && source === 'live'))
+                source = result.source;
+            unchecked += result.unchecked.length;
+            error ??= result.error;
+            const issues = advisoriesToIssues(packages, result, content);
+            if (issues.length > 0)
+                files.push({ uri: toUri(cwd, lockfile), issues, risk: computeRiskScore(issues) });
+        }
+        osv = { source, lockfiles: lockfiles.length, unchecked, ...(error ? { error } : {}) };
+    }
+    return {
+        tool: { name: 'mund', version: getVersion() },
+        risk: computeRiskScore(files.flatMap(f => f.issues)),
+        files_scanned: scanned,
+        ...(osv ? { osv } : {}),
+        files,
+    };
+}
+export function formatReport(report, format) {
+    if (format === 'json')
+        return JSON.stringify(report, null, 2);
+    if (format === 'sarif')
+        return JSON.stringify(toSarif(report.files, { toolVersion: report.tool.version }), null, 2);
+    const lines = [];
+    for (const file of report.files) {
+        lines.push(`${file.uri}  (risk ${file.risk.score}/100, ${file.risk.label})`);
+        for (const issue of file.issues) {
+            const where = issue.location?.line ? `${issue.location.line}:${issue.location.column ?? 1}` : '-';
+            lines.push(`  ${where.padEnd(8)} ${issue.severity.padEnd(8)} ${issue.rule_name}`);
+        }
+        lines.push('');
+    }
+    const total = report.files.reduce((n, f) => n + f.issues.length, 0);
+    const { counts } = report.risk;
+    lines.push(`Scanned ${report.files_scanned} file(s): ${total} finding(s) ` +
+        `(${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low)`);
+    lines.push(`Risk score: ${report.risk.score}/100 (${report.risk.label})`);
+    if (report.osv) {
+        const note = report.osv.source === 'live' ? 'live' : `${report.osv.source} - ${report.osv.error ?? ''}`.trim();
+        lines.push(`Dependencies: OSV.dev (${note})` + (report.osv.unchecked ? `, ${report.osv.unchecked} package(s) unchecked` : ''));
+    }
+    return lines.join('\n');
+}
+export function shouldFail(report, failOn) {
+    if (failOn === 'none')
+        return false;
+    const threshold = SEVERITY_RANK[failOn];
+    return report.files.some(f => f.issues.some((i) => SEVERITY_RANK[i.severity] <= threshold));
+}
+/** Entry point for `mund-mcp scan`. Returns the process exit code. */
+export async function runScanCli(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        process.stdout.write(SCAN_USAGE);
+        return 0;
+    }
+    let opts;
+    try {
+        opts = parseScanArgs(args);
+    }
+    catch (error) {
+        process.stderr.write(`mund scan: ${error.message}\n\n${SCAN_USAGE}`);
+        return 2;
+    }
+    const report = await runScan(opts);
+    const out = formatReport(report, opts.format) + '\n';
+    if (opts.output)
+        await writeFile(opts.output, out);
+    else
+        process.stdout.write(out);
+    return shouldFail(report, opts.failOn) ? 1 : 0;
+}
+async function collectFiles(roots) {
+    const out = [];
+    const walk = async (path) => {
+        const info = await stat(path).catch(() => null);
+        if (!info)
+            return;
+        if (info.isFile()) {
+            out.push(path);
+        }
+        else if (info.isDirectory()) {
+            for (const entry of await readdir(path, { withFileTypes: true })) {
+                if (entry.isDirectory() && SKIP_DIRS.has(entry.name))
+                    continue;
+                if (entry.isDirectory() || entry.isFile())
+                    await walk(join(path, entry.name));
+            }
+        }
+    };
+    for (const root of roots)
+        await walk(root);
+    return out.sort();
+}
+/** Read a file as UTF-8 text, or null if it's too big or looks binary. */
+async function readText(file) {
+    const info = await stat(file);
+    if (info.size > MAX_FILE_BYTES)
+        return null;
+    const buf = await readFile(file);
+    if (buf.subarray(0, 8000).includes(0))
+        return null;
+    return buf.toString('utf8');
+}
+function toUri(cwd, file) {
+    return relative(cwd, file).split(sep).join('/');
+}
+//# sourceMappingURL=scan.js.map

package/dist/cli/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAkB,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA2B7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AACtI,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACxE,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAErG,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;CAkBzB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,MAAM,IAAI,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEpH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxJ,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;gBAC3H,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC;YAChB,KAAK,IAAI;gBACP,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACtB,MAAM;YACR,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;gBAC7F,IAAI,CAAC,MAAM,GAAG,CAAW,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,UAAU;gBACb,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC5B,MAAM;YACR;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,SAAqB;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,mBAAmB,EAAE,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACpC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,OAAO,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,GAAsB,CAAC;IAC3B,IAAI,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,GAAc,MAAM,CAAC;QAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAyB,CAAC;QAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,yCAAyC;YACrD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,8CAA8C;YAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChH,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YACrC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;YAEvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpD,aAAa,EAAE,OAAO;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,MAAoB;IACnE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,aAAa,aAAa,KAAK,cAAc;QACxE,IAAI,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/G,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,MAAc;IAC3D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAe,KAAe,CAAC,OAAO,OAAO,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAe;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAiXH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AA0XH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -12,6 +12,9 @@ import { createStorage } from './storage/index.js';
 import { AnalyzerEngine } from './analyzers/index.js';
 import { NotificationHub } from './notifications/index.js';
 import { registerAllTools } from './tools/index.js';
+import { runScanCli } from './cli/scan.js';
+import { getVersion } from './version.js';
+import { loadCanariesFromEnv } from './canary.js';
 // Threat Intelligence imports
 import { threatIntel } from './threat-intel-manager.js';
 import { threatIntelTools, createThreatIntelToolHandlers, UpdateThreatIntelSchema, ListIntelSourcesSchema, IntelStatusSchema, AddIntelSourceSchema, RemoveIntelSourceSchema, ThreatScanSchema, ListPatternsSchema, TogglePatternSchema, } from './threat-intel-tools.js';
@@ -117,7 +120,7 @@ async function createMundServer(config) {
     // Create MCP server
     const server = new McpServer({
         name: 'mund-mcp-server',
-        version: '0.2.0'
+        version: getVersion()
     });
     // Initialize storage
     const storage = createStorage(config);
@@ -135,6 +138,7 @@ async function createMundServer(config) {
         }
     }
     // Register all core tools
+    loadCanariesFromEnv();
     registerAllTools(server, storage, rules, analyzer, notificationHub, config.block_mode);
     // Register threat intelligence tools
     registerThreatIntelTools(server);
@@ -165,7 +169,7 @@ async function runHTTP(config) {
     app.use(express.json({ limit: '10mb' }));
     // Health check endpoint
     app.get('/health', (_req, res) => {
-        res.json({ status: 'ok', version: '0.2.0' });
+        res.json({ status: 'ok', version: getVersion() });
     });
     // Threat intel status endpoint
     app.get('/intel/status', (_req, res) => {
@@ -194,7 +198,8 @@ function printHelp() {
 Mund - The Guardian Protocol
 MCP-based security monitoring for agentic AI systems
 
-Usage: mund-mcp [options]
+Usage: mund-mcp [options]          Run the MCP server
+       mund-mcp scan [paths...]    Scan files (see: mund-mcp scan --help)
 
 Options:
   --help, -h          Show this help message
@@ -252,13 +257,16 @@ For more information, visit: https://github.com/Tyox-all/Weave_Protocol
 }
 async function main() {
     const args = process.argv.slice(2);
+    if (args[0] === 'scan') {
+        process.exit(await runScanCli(args.slice(1)));
+    }
     // Parse CLI arguments
     if (args.includes('--help') || args.includes('-h')) {
         printHelp();
         process.exit(0);
     }
     if (args.includes('--version') || args.includes('-v')) {
-        console.log('0.2.0');
+        console.log(getVersion());
         process.exit(0);
     }
     // Load config