@weave_protocol/mund 0.3.0 → 0.3.1

package/dist/rugpull.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Mund - The Guardian Protocol
+ * MCP Rug-Pull Detection (OWASP ASI04)
+ *
+ * A rug pull is an MCP server that passes review at install time and
+ * then changes what its tools say or do. Static scanning can't see that,
+ * so Mund records a fingerprint of every tool when a server is first
+ * approved (the baseline) and diffs later manifests against it.
+ *
+ *   tool description changed  -> high   (the classic rug pull)
+ *   tool input schema changed -> medium
+ *   tool added                -> medium
+ *   tool removed              -> low
+ *   server name changed       -> high
+ *
+ * Any changed or added tool is re-scanned with the MCP analyzer; if it
+ * now trips a high/critical finding, or newly gains execution
+ * capability, the change is escalated to critical.
+ */
+import type { IAnalyzer, SecurityIssue, Severity } from './types.js';
+import { type McpServerManifest } from './analyzers/mcp-server-analyzer.js';
+export type ToolChangeKind = 'description_changed' | 'schema_changed' | 'tool_added' | 'tool_removed' | 'server_renamed';
+export interface ToolFingerprint {
+    descriptionHash: string;
+    schemaHash: string;
+    /** Kept so a diff can show what the description used to say. */
+    description: string;
+}
+export interface ManifestBaseline {
+    serverId: string;
+    serverName: string;
+    recordedAt: string;
+    tools: Record<string, ToolFingerprint>;
+}
+export interface ToolChange {
+    kind: ToolChangeKind;
+    tool: string;
+    severity: Severity;
+    detail: string;
+    /** Set when the changed tool now trips the MCP analyzer or gains execution capability. */
+    escalated?: string;
+}
+export interface RugPullResult {
+    serverId: string;
+    status: 'baseline_created' | 'unchanged' | 'changed';
+    changes: ToolChange[];
+    baselineRecordedAt?: string;
+}
+export declare function defaultBaselinePath(): string;
+export declare function fingerprintManifest(serverId: string, manifest: McpServerManifest): ManifestBaseline;
+/** Compare a manifest against its baseline. Pure: no I/O. */
+export declare function diffManifest(baseline: ManifestBaseline, manifest: McpServerManifest, analyzer?: IAnalyzer): Promise<ToolChange[]>;
+/** Persisted baselines, keyed by server id. */
+export declare class BaselineStore {
+    private path;
+    constructor(path?: string);
+    load(): Promise<Record<string, ManifestBaseline>>;
+    get(serverId: string): Promise<ManifestBaseline | undefined>;
+    put(baseline: ManifestBaseline): Promise<void>;
+}
+/**
+ * Check a manifest against its stored baseline. The first check for a
+ * server records the baseline. Pass acceptChanges to re-baseline after
+ * a human has reviewed the changes.
+ */
+export declare function checkRugPull(serverId: string, manifest: McpServerManifest, opts?: {
+    store?: BaselineStore;
+    analyzer?: IAnalyzer;
+    acceptChanges?: boolean;
+}): Promise<RugPullResult>;
+/** Express rug-pull changes as standard SecurityIssues (for scoring / SARIF). */
+export declare function changesToIssues(result: RugPullResult): SecurityIssue[];
+//# sourceMappingURL=rugpull.d.ts.map

package/dist/rugpull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rugpull.d.ts","sourceRoot":"","sources":["../src/rugpull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAqB,KAAK,iBAAiB,EAA0B,MAAM,oCAAoC,CAAC;AAEvH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,gBAAgB,CAAC;AAEzH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,kBAAkB,GAAG,WAAW,GAAG,SAAS,CAAC;IACrD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAcD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAUnG;AAED,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,GAAE,SAAmC,GAC5C,OAAO,CAAC,UAAU,EAAE,CAAC,CAgDvB;AAoBD,+CAA+C;AAC/C,qBAAa,aAAa;IACZ,OAAO,CAAC,IAAI;gBAAJ,IAAI,GAAE,MAA8B;IAElD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IASjD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAI5D,GAAG,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;CAMrD;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAClF,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,CAYtE"}

package/dist/rugpull.js

@@ -0,0 +1,177 @@
+/**
+ * Mund - The Guardian Protocol
+ * MCP Rug-Pull Detection (OWASP ASI04)
+ *
+ * A rug pull is an MCP server that passes review at install time and
+ * then changes what its tools say or do. Static scanning can't see that,
+ * so Mund records a fingerprint of every tool when a server is first
+ * approved (the baseline) and diffs later manifests against it.
+ *
+ *   tool description changed  -> high   (the classic rug pull)
+ *   tool input schema changed -> medium
+ *   tool added                -> medium
+ *   tool removed              -> low
+ *   server name changed       -> high
+ *
+ * Any changed or added tool is re-scanned with the MCP analyzer; if it
+ * now trips a high/critical finding, or newly gains execution
+ * capability, the change is escalated to critical.
+ */
+import { createHash } from 'crypto';
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+import { McpServerAnalyzer } from './analyzers/mcp-server-analyzer.js';
+const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+export function defaultBaselinePath() {
+    if (process.env.MUND_BASELINE_PATH)
+        return process.env.MUND_BASELINE_PATH;
+    const base = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    return join(base, 'mund', 'mcp-baselines.json');
+}
+/** Stable JSON: object keys sorted so equivalent schemas hash the same. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(',')}}`;
+    }
+    return JSON.stringify(value ?? null);
+}
+const sha256 = (s) => createHash('sha256').update(s).digest('hex');
+export function fingerprintManifest(serverId, manifest) {
+    const tools = {};
+    for (const tool of manifest.tools ?? []) {
+        tools[tool.name] = {
+            descriptionHash: sha256(tool.description ?? ''),
+            schemaHash: sha256(canonical(tool.inputSchema ?? {})),
+            description: (tool.description ?? '').slice(0, 2000),
+        };
+    }
+    return { serverId, serverName: manifest.name ?? serverId, recordedAt: new Date().toISOString(), tools };
+}
+/** Compare a manifest against its baseline. Pure: no I/O. */
+export async function diffManifest(baseline, manifest, analyzer = new McpServerAnalyzer()) {
+    const current = fingerprintManifest(baseline.serverId, manifest);
+    const byName = new Map((manifest.tools ?? []).map(t => [t.name, t]));
+    const changes = [];
+    if (current.serverName !== baseline.serverName) {
+        changes.push({
+            kind: 'server_renamed', tool: '*', severity: 'high',
+            detail: `Server name changed from "${baseline.serverName}" to "${current.serverName}"`,
+        });
+    }
+    for (const [name, now] of Object.entries(current.tools)) {
+        const before = baseline.tools[name];
+        if (!before) {
+            changes.push({ kind: 'tool_added', tool: name, severity: 'medium', detail: `New tool "${name}" not present at baseline` });
+            continue;
+        }
+        if (now.descriptionHash !== before.descriptionHash) {
+            changes.push({
+                kind: 'description_changed', tool: name, severity: 'high',
+                detail: `Description of "${name}" changed after approval`,
+            });
+        }
+        if (now.schemaHash !== before.schemaHash) {
+            changes.push({ kind: 'schema_changed', tool: name, severity: 'medium', detail: `Input schema of "${name}" changed after approval` });
+        }
+    }
+    for (const name of Object.keys(baseline.tools)) {
+        if (!current.tools[name]) {
+            changes.push({ kind: 'tool_removed', tool: name, severity: 'low', detail: `Tool "${name}" removed since baseline` });
+        }
+    }
+    // Escalate changed/added tools that now look dangerous.
+    for (const change of changes) {
+        if (change.kind === 'tool_removed' || change.kind === 'server_renamed')
+            continue;
+        const tool = byName.get(change.tool);
+        if (!tool)
+            continue;
+        const reason = await escalationReason(tool, baseline.tools[change.tool], analyzer);
+        if (reason) {
+            change.severity = 'critical';
+            change.escalated = reason;
+        }
+    }
+    return changes.sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]);
+}
+async function escalationReason(tool, before, analyzer) {
+    const single = JSON.stringify({ name: 'rugpull-check', tools: [tool] });
+    const findings = await analyzer.analyze(single, []);
+    const serious = findings.find(f => f.severity === 'critical' || f.severity === 'high');
+    if (serious)
+        return `Changed tool now triggers "${serious.rule_name}"`;
+    const nowExec = McpServerAnalyzer.analyzeCapabilities({ name: 'x', version: '0', tools: [tool] }).execution;
+    const wasExec = before
+        ? McpServerAnalyzer.analyzeCapabilities({ name: 'x', version: '0', tools: [{ name: tool.name, description: before.description }] }).execution
+        : false;
+    if (nowExec && !wasExec)
+        return 'Tool newly requests command-execution capability';
+    return undefined;
+}
+/** Persisted baselines, keyed by server id. */
+export class BaselineStore {
+    path;
+    constructor(path = defaultBaselinePath()) {
+        this.path = path;
+    }
+    async load() {
+        try {
+            const data = JSON.parse(await readFile(this.path, 'utf8'));
+            return data && typeof data === 'object' && data.version === 1 ? data.baselines : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    async get(serverId) {
+        return (await this.load())[serverId];
+    }
+    async put(baseline) {
+        const all = await this.load();
+        all[baseline.serverId] = baseline;
+        await mkdir(dirname(this.path), { recursive: true });
+        await writeFile(this.path, JSON.stringify({ version: 1, baselines: all }, null, 2));
+    }
+}
+/**
+ * Check a manifest against its stored baseline. The first check for a
+ * server records the baseline. Pass acceptChanges to re-baseline after
+ * a human has reviewed the changes.
+ */
+export async function checkRugPull(serverId, manifest, opts = {}) {
+    const store = opts.store ?? new BaselineStore();
+    const baseline = await store.get(serverId);
+    if (!baseline) {
+        await store.put(fingerprintManifest(serverId, manifest));
+        return { serverId, status: 'baseline_created', changes: [] };
+    }
+    const changes = await diffManifest(baseline, manifest, opts.analyzer);
+    if (opts.acceptChanges && changes.length > 0) {
+        await store.put(fingerprintManifest(serverId, manifest));
+    }
+    return {
+        serverId,
+        status: changes.length > 0 ? 'changed' : 'unchanged',
+        changes,
+        baselineRecordedAt: baseline.recordedAt,
+    };
+}
+/** Express rug-pull changes as standard SecurityIssues (for scoring / SARIF). */
+export function changesToIssues(result) {
+    return result.changes.map(c => ({
+        rule_id: `mcp_rugpull_${c.kind}`,
+        rule_name: `MCP rug pull: ${c.detail}`,
+        type: 'mcp_rugpull',
+        severity: c.severity,
+        action: c.severity === 'critical' || c.severity === 'high' ? 'block' : 'alert',
+        match: `${result.serverId}:${c.tool}`,
+        suggestion: c.escalated
+            ? `${c.escalated}. Do not use this server until the change is reviewed.`
+            : 'Review the change before continuing to use this server; accept it to update the baseline.',
+    }));
+}
+//# sourceMappingURL=rugpull.js.map

package/dist/rugpull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rugpull.js","sourceRoot":"","sources":["../src/rugpull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAkD,MAAM,oCAAoC,CAAC;AAkCvH,MAAM,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAErG,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAClD,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3E,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,QAA2B;IAC/E,MAAM,KAAK,GAAoC,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjB,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/C,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrD,WAAW,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC;AAC1G,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA0B,EAC1B,QAA2B,EAC3B,WAAsB,IAAI,iBAAiB,EAAE;IAE7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM;YACnD,MAAM,EAAE,6BAA6B,QAAQ,CAAC,UAAU,SAAS,OAAO,CAAC,UAAU,GAAG;SACvF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,IAAI,2BAA2B,EAAE,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM;gBACzD,MAAM,EAAE,mBAAmB,IAAI,0BAA0B;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,IAAI,0BAA0B,EAAE,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,0BAA0B,EAAE,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QACjF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC7B,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAuB,EACvB,MAAmC,EACnC,QAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO;QAAE,OAAO,8BAA8B,OAAO,CAAC,SAAS,GAAG,CAAC;IAEvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAC5G,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;QAC7I,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,kDAAkD,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+CAA+C;AAC/C,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,OAAe,mBAAmB,EAAE;QAApC,SAAI,GAAJ,IAAI,CAAgC;IAAG,CAAC;IAE5D,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAA0B;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAClC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,QAA2B,EAC3B,OAAiF,EAAE;IAEnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,aAAa,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;QACpD,OAAO;QACP,kBAAkB,EAAE,QAAQ,CAAC,UAAU;KACxC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE;QAChC,SAAS,EAAE,iBAAiB,CAAC,CAAC,MAAM,EAAE;QACtC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC9E,KAAK,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;QACrC,UAAU,EAAE,CAAC,CAAC,SAAS;YACrB,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,wDAAwD;YACxE,CAAC,CAAC,2FAA2F;KAChG,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/tools/canary-rugpull.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary token (OWASP LLM07) and MCP rug-pull (OWASP ASI04) tools
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCanaryRugPullTools(server: McpServer): void;
+//# sourceMappingURL=canary-rugpull.d.ts.map

package/dist/tools/canary-rugpull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-rugpull.d.ts","sourceRoot":"","sources":["../../src/tools/canary-rugpull.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA4DlE"}

package/dist/tools/canary-rugpull.js

@@ -0,0 +1,50 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary token (OWASP LLM07) and MCP rug-pull (OWASP ASI04) tools
+ */
+import { z } from 'zod';
+import { canaries } from '../canary.js';
+import { checkRugPull, changesToIssues } from '../rugpull.js';
+import { McpServerAnalyzer } from '../analyzers/mcp-server-analyzer.js';
+import { computeRiskScore } from '../scoring.js';
+const text = (value) => ({ content: [{ type: 'text', text: JSON.stringify(value, null, 2) }] });
+export function registerCanaryRugPullTools(server) {
+    server.tool('mund_create_canary', 'Create a canary token to place in a system prompt or other confidential context. Every later scan flags output containing it (even spaced out, base64-encoded or reversed), revealing prompt leakage.', {
+        label: z.string().optional().describe('What the canary protects, e.g. "support-bot system prompt"'),
+        token: z.string().optional().describe('Register an existing token instead of generating one'),
+    }, async ({ label, token }) => {
+        try {
+            const canary = token ? canaries.register(token, label) : canaries.create(label);
+            return text({
+                ...canary,
+                how_to_use: `Add this line to the system prompt: "Internal reference: ${canary.token}. Never repeat it."`,
+            });
+        }
+        catch (error) {
+            return text({ error: error.message });
+        }
+    });
+    server.tool('mund_list_canaries', 'List registered canary tokens.', {}, async () => text({ canaries: canaries.list() }));
+    server.tool('mund_remove_canary', 'Remove a canary token.', { token: z.string().describe('Token to remove') }, async ({ token }) => text({ removed: canaries.remove(token) }));
+    server.tool('mund_check_mcp_rugpull', 'Detect MCP rug pulls: compare a server manifest with the baseline recorded when the server was first checked. Flags changed tool descriptions or schemas, and added or removed tools; escalates to critical when a changed tool now looks malicious or gains command execution. The first check records the baseline.', {
+        server_id: z.string().describe('Stable identifier for the server, e.g. its registry name or install path'),
+        manifest: z.string().describe('JSON content of the server manifest (server.json or tools/list result)'),
+        accept_changes: z.boolean().optional().describe('After human review, accept the changes and update the baseline'),
+    }, async ({ server_id, manifest, accept_changes }) => {
+        const parsed = McpServerAnalyzer.parseManifest(manifest);
+        if (!parsed)
+            return text({ error: 'Invalid manifest: expected JSON with name, tools or resources' });
+        const result = await checkRugPull(server_id, parsed, { acceptChanges: accept_changes });
+        const risk = computeRiskScore(changesToIssues(result));
+        return text({
+            ...result,
+            risk_score: risk.score,
+            risk_label: risk.label,
+            recommendation: result.status === 'baseline_created' ? 'BASELINE_RECORDED'
+                : result.changes.some(c => c.severity === 'critical') ? 'DO_NOT_USE'
+                    : result.changes.length > 0 ? (accept_changes ? 'CHANGES_ACCEPTED' : 'REVIEW_CHANGES')
+                        : 'UNCHANGED',
+        });
+    });
+}
+//# sourceMappingURL=canary-rugpull.js.map

package/dist/tools/canary-rugpull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-rugpull.js","sourceRoot":"","sources":["../../src/tools/canary-rugpull.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAElH,MAAM,UAAU,0BAA0B,CAAC,MAAiB;IAC1D,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,uMAAuM,EACvM;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;QACnG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;KAC9F,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC;gBACV,GAAG,MAAM;gBACT,UAAU,EAAE,4DAA4D,MAAM,CAAC,KAAK,qBAAqB;aAC1G,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,gCAAgC,EAChC,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAChD,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,wBAAwB,EACxB,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,EACjD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC/D,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,uTAAuT,EACvT;QACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;QAC1G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;QACvG,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;KAClH,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,gBAAgB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;YACV,GAAG,MAAM;YACT,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,cAAc,EACZ,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,mBAAmB;gBAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY;oBACpE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC;wBACtF,CAAC,CAAC,WAAW;SAChB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -5,6 +5,7 @@
 export { registerMonitoringTools } from './monitoring.js';
 export { registerConfigurationTools } from './configuration.js';
 export { registerMcpScanningTools } from './mcp-scanning.js';
+export { registerCanaryRugPullTools } from './canary-rugpull.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { IStorage, DetectionRule } from '../types.js';
 import { AnalyzerEngine } from '../analyzers/index.js';

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAK7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,aAAa,EAAE,EACtB,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,OAAO,GACjB,IAAI,CASN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAMjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,aAAa,EAAE,EACtB,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,OAAO,GACjB,IAAI,CAYN"}

package/dist/tools/index.js

@@ -5,9 +5,11 @@
 export { registerMonitoringTools } from './monitoring.js';
 export { registerConfigurationTools } from './configuration.js';
 export { registerMcpScanningTools } from './mcp-scanning.js';
+export { registerCanaryRugPullTools } from './canary-rugpull.js';
 import { registerMonitoringTools } from './monitoring.js';
 import { registerConfigurationTools } from './configuration.js';
 import { registerMcpScanningTools } from './mcp-scanning.js';
+import { registerCanaryRugPullTools } from './canary-rugpull.js';
 /**
  * Register all Mund MCP tools
  */
@@ -18,5 +20,7 @@ export function registerAllTools(server, storage, rules, analyzer, notificationH
     registerConfigurationTools(server, storage, rules);
     // MCP server scanning tools (new)
     registerMcpScanningTools(server);
+    // Canary tokens (LLM07) and MCP rug-pull detection (ASI04)
+    registerCanaryRugPullTools(server);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAM7D;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,OAAiB,EACjB,KAAsB,EACtB,QAAwB,EACxB,eAAgC,EAChC,SAAkB;IAElB,wBAAwB;IACxB,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAEtF,iCAAiC;IACjC,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnD,kCAAkC;IAClC,wBAAwB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAMjE;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,OAAiB,EACjB,KAAsB,EACtB,QAAwB,EACxB,eAAgC,EAChC,SAAkB;IAElB,wBAAwB;IACxB,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAEtF,iCAAiC;IACjC,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnD,kCAAkC;IAClC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEjC,2DAA2D;IAC3D,0BAA0B,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weave_protocol/mund",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "The Guardian Protocol - MCP-based security monitoring for agentic AI systems",
   "main": "dist/index.js",
   "bin": {

package/src/analyzers/index.ts

@@ -16,6 +16,7 @@ import { CodeAnalyzer } from './code-analyzer.js';
 import { InjectionDetector } from './injection-detector.js';
 import { ExfiltrationDetector } from './exfiltration-detector.js';
 import { McpServerAnalyzer } from './mcp-server-analyzer.js';
+import { CanaryDetector } from '../canary.js';
 import type { IAnalyzer } from '../types.js';
 
 /**
@@ -28,7 +29,8 @@ export function getAnalyzers(): IAnalyzer[] {
     new CodeAnalyzer(),
     new InjectionDetector(),
     new ExfiltrationDetector(),
-    new McpServerAnalyzer()
+    new McpServerAnalyzer(),
+    new CanaryDetector()
   ];
 }
 

package/src/canary.ts

@@ -0,0 +1,165 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary Tokens - detect system prompt leakage (OWASP LLM07)
+ *
+ * Generate a unique marker, place it in your system prompt (or any
+ * confidential context), and Mund flags any scanned output that
+ * contains it. A model that has been talked into revealing its
+ * instructions reveals the canary with them.
+ *
+ * Matching tolerates the cheap evasions a leaking model or an attacker
+ * might apply: case changes, inserted whitespace / zero-width
+ * characters / punctuation, base64 encoding, and reversal.
+ */
+
+import { randomBytes } from 'crypto';
+import { readFileSync } from 'fs';
+import type { DetectionRule, IAnalyzer, SecurityIssue } from './types.js';
+
+export interface Canary {
+  token: string;
+  label: string;
+  createdAt: string;
+}
+
+export type CanaryMatchKind = 'exact' | 'obfuscated' | 'base64' | 'reversed';
+
+const TOKEN_PREFIX = 'MUND-CANARY-';
+const MIN_TOKEN_LENGTH = 12;
+const ZERO_WIDTH = /[​-‍⁠]/g;
+
+/** Lowercase and keep only letters and digits. */
+function squash(text: string): string {
+  return text.replace(ZERO_WIDTH, '').toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
+export class CanaryRegistry {
+  private canaries = new Map<string, Canary>();
+
+  /** Create a new random canary token. */
+  create(label = 'system-prompt'): Canary {
+    const canary: Canary = {
+      token: TOKEN_PREFIX + randomBytes(8).toString('hex').toUpperCase(),
+      label,
+      createdAt: new Date().toISOString(),
+    };
+    this.canaries.set(canary.token, canary);
+    return canary;
+  }
+
+  /** Register an existing token (e.g. one already deployed in a prompt). */
+  register(token: string, label = 'system-prompt'): Canary {
+    if (squash(token).length < MIN_TOKEN_LENGTH) {
+      throw new Error(`Canary token must contain at least ${MIN_TOKEN_LENGTH} letters/digits to avoid false positives`);
+    }
+    const canary: Canary = { token, label, createdAt: new Date().toISOString() };
+    this.canaries.set(token, canary);
+    return canary;
+  }
+
+  remove(token: string): boolean {
+    return this.canaries.delete(token);
+  }
+
+  list(): Canary[] {
+    return [...this.canaries.values()];
+  }
+
+  get size(): number {
+    return this.canaries.size;
+  }
+
+  /** Find every registered canary that appears in the content. */
+  find(content: string): Array<{ canary: Canary; kind: CanaryMatchKind; index: number }> {
+    const hits: Array<{ canary: Canary; kind: CanaryMatchKind; index: number }> = [];
+    if (this.canaries.size === 0 || !content) return hits;
+
+    const lower = content.toLowerCase();
+    const squashed = squash(content);
+    const decoded = decodeBase64Runs(content).map(squash);
+
+    for (const canary of this.canaries.values()) {
+      const needle = squash(canary.token);
+      const exactAt = lower.indexOf(canary.token.toLowerCase());
+
+      if (exactAt !== -1) {
+        hits.push({ canary, kind: 'exact', index: exactAt });
+      } else if (squashed.includes(needle)) {
+        hits.push({ canary, kind: 'obfuscated', index: -1 });
+      } else if (decoded.some(d => d.includes(needle))) {
+        hits.push({ canary, kind: 'base64', index: -1 });
+      } else if (squashed.includes([...needle].reverse().join(''))) {
+        hits.push({ canary, kind: 'reversed', index: -1 });
+      }
+    }
+    return hits;
+  }
+}
+
+/** Decode every plausible base64 run in the text (best effort). */
+function decodeBase64Runs(content: string): string[] {
+  const runs = content.match(/[A-Za-z0-9+/]{16,}={0,2}/g) ?? [];
+  const out: string[] = [];
+  for (const run of runs) {
+    try {
+      const text = Buffer.from(run, 'base64').toString('utf8');
+      if (/^[\x20-\x7E\s]+$/.test(text)) out.push(text);
+    } catch {
+      // not base64
+    }
+  }
+  return out;
+}
+
+/** Shared registry used by the MCP tools and the default analyzer set. */
+export const canaries = new CanaryRegistry();
+
+/** Load canaries from MUND_CANARIES (comma-separated) or MUND_CANARY_FILE (one per line). */
+export function loadCanariesFromEnv(registry: CanaryRegistry = canaries): number {
+  const tokens: string[] = [];
+  if (process.env.MUND_CANARIES) tokens.push(...process.env.MUND_CANARIES.split(','));
+  if (process.env.MUND_CANARY_FILE) {
+    try {
+      tokens.push(...readFileSync(process.env.MUND_CANARY_FILE, 'utf8').split('\n'));
+    } catch {
+      // missing file: nothing to load
+    }
+  }
+  let loaded = 0;
+  for (const t of tokens.map(t => t.trim()).filter(Boolean)) {
+    try {
+      registry.register(t, 'env');
+      loaded++;
+    } catch {
+      // too short; skip
+    }
+  }
+  return loaded;
+}
+
+export class CanaryDetector implements IAnalyzer {
+  name = 'CanaryDetector';
+  type = 'exfiltration';
+
+  constructor(private registry: CanaryRegistry = canaries) {}
+
+  async analyze(content: string, _rules: DetectionRule[]): Promise<SecurityIssue[]> {
+    return this.registry.find(content).map(({ canary, kind, index }) => {
+      const before = index >= 0 ? content.slice(0, index).split('\n') : null;
+      return {
+        rule_id: 'canary_leak',
+        rule_name: `Canary token leaked (${kind})`,
+        type: 'exfiltration',
+        severity: 'critical',
+        action: 'block',
+        match: `${canary.token.slice(0, TOKEN_PREFIX.length + 4)}…`,
+        ...(before
+          ? { location: { start: index, end: index + canary.token.length, line: before.length, column: before[before.length - 1].length + 1 } }
+          : {}),
+        suggestion:
+          `Content contains the "${canary.label}" canary, so confidential instructions or context are leaking. ` +
+          'Block this output and review the prompt that produced it.',
+      };
+    });
+  }
+}

package/src/cli/scan.ts

@@ -16,6 +16,7 @@ import { computeRiskScore, type RiskScore } from '../scoring.js';
 import { toSarif, type SarifTarget } from '../sarif.js';
 import { OsvClient, parseNpmLockfile, advisoriesToIssues, type OsvSource } from '../osv.js';
 import { getVersion } from '../version.js';
+import { canaries, loadCanariesFromEnv } from '../canary.js';
 
 export type OutputFormat = 'text' | 'json' | 'sarif';
 type FailOn = Severity | 'none';
@@ -27,6 +28,7 @@ export interface ScanCliOptions {
   failOn: FailOn;
   osv: boolean;
   offline: boolean;
+  canaries: string[];
 }
 
 export interface FileReport extends SarifTarget {
@@ -58,6 +60,8 @@ Options:
                      (critical, high [default], medium, low, none)
   --no-osv           Skip dependency vulnerability lookups
   --offline          Use only the local OSV cache (also: MUND_OFFLINE=1)
+  --canary=TOKEN     Flag any file containing this canary token (repeatable;
+                     also MUND_CANARIES / MUND_CANARY_FILE)
 
 Examples:
   mund-mcp scan .
@@ -65,7 +69,7 @@ Examples:
 `;
 
 export function parseScanArgs(args: string[]): ScanCliOptions {
-  const opts: ScanCliOptions = { paths: [], format: 'text', failOn: 'high', osv: true, offline: false };
+  const opts: ScanCliOptions = { paths: [], format: 'text', failOn: 'high', osv: true, offline: false, canaries: [] };
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -99,6 +103,9 @@ export function parseScanArgs(args: string[]): ScanCliOptions {
       case '--offline':
         opts.offline = true;
         break;
+      case '--canary':
+        opts.canaries.push(value());
+        break;
       default:
         if (flag.startsWith('-')) throw new Error(`Unknown option ${flag}`);
         opts.paths.push(arg);
@@ -111,6 +118,8 @@ export function parseScanArgs(args: string[]): ScanCliOptions {
 
 export async function runScan(opts: ScanCliOptions, osvClient?: OsvClient): Promise<ScanReport> {
   const cwd = process.cwd();
+  loadCanariesFromEnv();
+  for (const token of opts.canaries) canaries.register(token, 'cli');
   const engine = new AnalyzerEngine();
   const files: FileReport[] = [];
   const lockfiles: string[] = [];

package/src/index.ts

@@ -17,6 +17,7 @@ import { NotificationHub } from './notifications/index.js';
 import { registerAllTools } from './tools/index.js';
 import { runScanCli } from './cli/scan.js';
 import { getVersion } from './version.js';
+import { loadCanariesFromEnv } from './canary.js';
 
 // Threat Intelligence imports
 import { threatIntel } from './threat-intel-manager.js';
@@ -180,6 +181,7 @@ async function createMundServer(config: MundConfig): Promise<McpServer> {
   }
 
   // Register all core tools
+  loadCanariesFromEnv();
   registerAllTools(server, storage, rules, analyzer, notificationHub, config.block_mode);
 
   // Register threat intelligence tools