@weave_protocol/mund 0.3.0 → 0.3.1

package/src/rugpull.ts

@@ -0,0 +1,233 @@
+/**
+ * Mund - The Guardian Protocol
+ * MCP Rug-Pull Detection (OWASP ASI04)
+ *
+ * A rug pull is an MCP server that passes review at install time and
+ * then changes what its tools say or do. Static scanning can't see that,
+ * so Mund records a fingerprint of every tool when a server is first
+ * approved (the baseline) and diffs later manifests against it.
+ *
+ *   tool description changed  -> high   (the classic rug pull)
+ *   tool input schema changed -> medium
+ *   tool added                -> medium
+ *   tool removed              -> low
+ *   server name changed       -> high
+ *
+ * Any changed or added tool is re-scanned with the MCP analyzer; if it
+ * now trips a high/critical finding, or newly gains execution
+ * capability, the change is escalated to critical.
+ */
+
+import { createHash } from 'crypto';
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+import type { IAnalyzer, SecurityIssue, Severity } from './types.js';
+import { McpServerAnalyzer, type McpServerManifest, type McpToolDefinition } from './analyzers/mcp-server-analyzer.js';
+
+export type ToolChangeKind = 'description_changed' | 'schema_changed' | 'tool_added' | 'tool_removed' | 'server_renamed';
+
+export interface ToolFingerprint {
+  descriptionHash: string;
+  schemaHash: string;
+  /** Kept so a diff can show what the description used to say. */
+  description: string;
+}
+
+export interface ManifestBaseline {
+  serverId: string;
+  serverName: string;
+  recordedAt: string;
+  tools: Record<string, ToolFingerprint>;
+}
+
+export interface ToolChange {
+  kind: ToolChangeKind;
+  tool: string;
+  severity: Severity;
+  detail: string;
+  /** Set when the changed tool now trips the MCP analyzer or gains execution capability. */
+  escalated?: string;
+}
+
+export interface RugPullResult {
+  serverId: string;
+  status: 'baseline_created' | 'unchanged' | 'changed';
+  changes: ToolChange[];
+  baselineRecordedAt?: string;
+}
+
+const SEVERITY_RANK: Record<Severity, number> = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+
+export function defaultBaselinePath(): string {
+  if (process.env.MUND_BASELINE_PATH) return process.env.MUND_BASELINE_PATH;
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+  return join(base, 'mund', 'mcp-baselines.json');
+}
+
+/** Stable JSON: object keys sorted so equivalent schemas hash the same. */
+function canonical(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(',')}}`;
+  }
+  return JSON.stringify(value ?? null);
+}
+
+const sha256 = (s: string) => createHash('sha256').update(s).digest('hex');
+
+export function fingerprintManifest(serverId: string, manifest: McpServerManifest): ManifestBaseline {
+  const tools: Record<string, ToolFingerprint> = {};
+  for (const tool of manifest.tools ?? []) {
+    tools[tool.name] = {
+      descriptionHash: sha256(tool.description ?? ''),
+      schemaHash: sha256(canonical(tool.inputSchema ?? {})),
+      description: (tool.description ?? '').slice(0, 2000),
+    };
+  }
+  return { serverId, serverName: manifest.name ?? serverId, recordedAt: new Date().toISOString(), tools };
+}
+
+/** Compare a manifest against its baseline. Pure: no I/O. */
+export async function diffManifest(
+  baseline: ManifestBaseline,
+  manifest: McpServerManifest,
+  analyzer: IAnalyzer = new McpServerAnalyzer(),
+): Promise<ToolChange[]> {
+  const current = fingerprintManifest(baseline.serverId, manifest);
+  const byName = new Map((manifest.tools ?? []).map(t => [t.name, t]));
+  const changes: ToolChange[] = [];
+
+  if (current.serverName !== baseline.serverName) {
+    changes.push({
+      kind: 'server_renamed', tool: '*', severity: 'high',
+      detail: `Server name changed from "${baseline.serverName}" to "${current.serverName}"`,
+    });
+  }
+
+  for (const [name, now] of Object.entries(current.tools)) {
+    const before = baseline.tools[name];
+    if (!before) {
+      changes.push({ kind: 'tool_added', tool: name, severity: 'medium', detail: `New tool "${name}" not present at baseline` });
+      continue;
+    }
+    if (now.descriptionHash !== before.descriptionHash) {
+      changes.push({
+        kind: 'description_changed', tool: name, severity: 'high',
+        detail: `Description of "${name}" changed after approval`,
+      });
+    }
+    if (now.schemaHash !== before.schemaHash) {
+      changes.push({ kind: 'schema_changed', tool: name, severity: 'medium', detail: `Input schema of "${name}" changed after approval` });
+    }
+  }
+
+  for (const name of Object.keys(baseline.tools)) {
+    if (!current.tools[name]) {
+      changes.push({ kind: 'tool_removed', tool: name, severity: 'low', detail: `Tool "${name}" removed since baseline` });
+    }
+  }
+
+  // Escalate changed/added tools that now look dangerous.
+  for (const change of changes) {
+    if (change.kind === 'tool_removed' || change.kind === 'server_renamed') continue;
+    const tool = byName.get(change.tool);
+    if (!tool) continue;
+    const reason = await escalationReason(tool, baseline.tools[change.tool], analyzer);
+    if (reason) {
+      change.severity = 'critical';
+      change.escalated = reason;
+    }
+  }
+
+  return changes.sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]);
+}
+
+async function escalationReason(
+  tool: McpToolDefinition,
+  before: ToolFingerprint | undefined,
+  analyzer: IAnalyzer,
+): Promise<string | undefined> {
+  const single = JSON.stringify({ name: 'rugpull-check', tools: [tool] });
+  const findings = await analyzer.analyze(single, []);
+  const serious = findings.find(f => f.severity === 'critical' || f.severity === 'high');
+  if (serious) return `Changed tool now triggers "${serious.rule_name}"`;
+
+  const nowExec = McpServerAnalyzer.analyzeCapabilities({ name: 'x', version: '0', tools: [tool] }).execution;
+  const wasExec = before
+    ? McpServerAnalyzer.analyzeCapabilities({ name: 'x', version: '0', tools: [{ name: tool.name, description: before.description }] }).execution
+    : false;
+  if (nowExec && !wasExec) return 'Tool newly requests command-execution capability';
+  return undefined;
+}
+
+/** Persisted baselines, keyed by server id. */
+export class BaselineStore {
+  constructor(private path: string = defaultBaselinePath()) {}
+
+  async load(): Promise<Record<string, ManifestBaseline>> {
+    try {
+      const data = JSON.parse(await readFile(this.path, 'utf8'));
+      return data && typeof data === 'object' && data.version === 1 ? data.baselines : {};
+    } catch {
+      return {};
+    }
+  }
+
+  async get(serverId: string): Promise<ManifestBaseline | undefined> {
+    return (await this.load())[serverId];
+  }
+
+  async put(baseline: ManifestBaseline): Promise<void> {
+    const all = await this.load();
+    all[baseline.serverId] = baseline;
+    await mkdir(dirname(this.path), { recursive: true });
+    await writeFile(this.path, JSON.stringify({ version: 1, baselines: all }, null, 2));
+  }
+}
+
+/**
+ * Check a manifest against its stored baseline. The first check for a
+ * server records the baseline. Pass acceptChanges to re-baseline after
+ * a human has reviewed the changes.
+ */
+export async function checkRugPull(
+  serverId: string,
+  manifest: McpServerManifest,
+  opts: { store?: BaselineStore; analyzer?: IAnalyzer; acceptChanges?: boolean } = {},
+): Promise<RugPullResult> {
+  const store = opts.store ?? new BaselineStore();
+  const baseline = await store.get(serverId);
+
+  if (!baseline) {
+    await store.put(fingerprintManifest(serverId, manifest));
+    return { serverId, status: 'baseline_created', changes: [] };
+  }
+
+  const changes = await diffManifest(baseline, manifest, opts.analyzer);
+  if (opts.acceptChanges && changes.length > 0) {
+    await store.put(fingerprintManifest(serverId, manifest));
+  }
+  return {
+    serverId,
+    status: changes.length > 0 ? 'changed' : 'unchanged',
+    changes,
+    baselineRecordedAt: baseline.recordedAt,
+  };
+}
+
+/** Express rug-pull changes as standard SecurityIssues (for scoring / SARIF). */
+export function changesToIssues(result: RugPullResult): SecurityIssue[] {
+  return result.changes.map(c => ({
+    rule_id: `mcp_rugpull_${c.kind}`,
+    rule_name: `MCP rug pull: ${c.detail}`,
+    type: 'mcp_rugpull',
+    severity: c.severity,
+    action: c.severity === 'critical' || c.severity === 'high' ? 'block' : 'alert',
+    match: `${result.serverId}:${c.tool}`,
+    suggestion: c.escalated
+      ? `${c.escalated}. Do not use this server until the change is reviewed.`
+      : 'Review the change before continuing to use this server; accept it to update the baseline.',
+  }));
+}

package/src/tools/canary-rugpull.ts

@@ -0,0 +1,75 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary token (OWASP LLM07) and MCP rug-pull (OWASP ASI04) tools
+ */
+
+import { z } from 'zod';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { canaries } from '../canary.js';
+import { checkRugPull, changesToIssues } from '../rugpull.js';
+import { McpServerAnalyzer } from '../analyzers/mcp-server-analyzer.js';
+import { computeRiskScore } from '../scoring.js';
+
+const text = (value: unknown) => ({ content: [{ type: 'text' as const, text: JSON.stringify(value, null, 2) }] });
+
+export function registerCanaryRugPullTools(server: McpServer): void {
+  server.tool(
+    'mund_create_canary',
+    'Create a canary token to place in a system prompt or other confidential context. Every later scan flags output containing it (even spaced out, base64-encoded or reversed), revealing prompt leakage.',
+    {
+      label: z.string().optional().describe('What the canary protects, e.g. "support-bot system prompt"'),
+      token: z.string().optional().describe('Register an existing token instead of generating one'),
+    },
+    async ({ label, token }) => {
+      try {
+        const canary = token ? canaries.register(token, label) : canaries.create(label);
+        return text({
+          ...canary,
+          how_to_use: `Add this line to the system prompt: "Internal reference: ${canary.token}. Never repeat it."`,
+        });
+      } catch (error) {
+        return text({ error: (error as Error).message });
+      }
+    },
+  );
+
+  server.tool(
+    'mund_list_canaries',
+    'List registered canary tokens.',
+    {},
+    async () => text({ canaries: canaries.list() }),
+  );
+
+  server.tool(
+    'mund_remove_canary',
+    'Remove a canary token.',
+    { token: z.string().describe('Token to remove') },
+    async ({ token }) => text({ removed: canaries.remove(token) }),
+  );
+
+  server.tool(
+    'mund_check_mcp_rugpull',
+    'Detect MCP rug pulls: compare a server manifest with the baseline recorded when the server was first checked. Flags changed tool descriptions or schemas, and added or removed tools; escalates to critical when a changed tool now looks malicious or gains command execution. The first check records the baseline.',
+    {
+      server_id: z.string().describe('Stable identifier for the server, e.g. its registry name or install path'),
+      manifest: z.string().describe('JSON content of the server manifest (server.json or tools/list result)'),
+      accept_changes: z.boolean().optional().describe('After human review, accept the changes and update the baseline'),
+    },
+    async ({ server_id, manifest, accept_changes }) => {
+      const parsed = McpServerAnalyzer.parseManifest(manifest);
+      if (!parsed) return text({ error: 'Invalid manifest: expected JSON with name, tools or resources' });
+      const result = await checkRugPull(server_id, parsed, { acceptChanges: accept_changes });
+      const risk = computeRiskScore(changesToIssues(result));
+      return text({
+        ...result,
+        risk_score: risk.score,
+        risk_label: risk.label,
+        recommendation:
+          result.status === 'baseline_created' ? 'BASELINE_RECORDED'
+          : result.changes.some(c => c.severity === 'critical') ? 'DO_NOT_USE'
+          : result.changes.length > 0 ? (accept_changes ? 'CHANGES_ACCEPTED' : 'REVIEW_CHANGES')
+          : 'UNCHANGED',
+      });
+    },
+  );
+}

package/src/tools/index.ts

@@ -6,10 +6,12 @@
 export { registerMonitoringTools } from './monitoring.js';
 export { registerConfigurationTools } from './configuration.js';
 export { registerMcpScanningTools } from './mcp-scanning.js';
+export { registerCanaryRugPullTools } from './canary-rugpull.js';
 
 import { registerMonitoringTools } from './monitoring.js';
 import { registerConfigurationTools } from './configuration.js';
 import { registerMcpScanningTools } from './mcp-scanning.js';
+import { registerCanaryRugPullTools } from './canary-rugpull.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { IStorage, DetectionRule } from '../types.js';
 import { AnalyzerEngine } from '../analyzers/index.js';
@@ -34,4 +36,7 @@ export function registerAllTools(
   
   // MCP server scanning tools (new)
   registerMcpScanningTools(server);
+
+  // Canary tokens (LLM07) and MCP rug-pull detection (ASI04)
+  registerCanaryRugPullTools(server);
 }

package/tests/analyzers/engine.test.ts

@@ -17,7 +17,7 @@ describe('AnalyzerEngine', () => {
 
   it('includes every analyzer by default', () => {
     expect(new AnalyzerEngine().getAnalyzerNames()).toEqual(getAnalyzers().map(a => a.name));
-    expect(getAnalyzers()).toHaveLength(6);
+    expect(getAnalyzers()).toHaveLength(7);
   });
 
   it('sorts high/medium/low in severity order', async () => {

package/tests/canary.test.ts

@@ -0,0 +1,79 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { CanaryDetector, CanaryRegistry, canaries, loadCanariesFromEnv } from '../src/canary.js';
+import { parseScanArgs, runScan, shouldFail } from '../src/cli/scan.js';
+
+describe('CanaryRegistry', () => {
+  it('creates unique prefixed tokens', () => {
+    const r = new CanaryRegistry();
+    const a = r.create('a');
+    const b = r.create('b');
+    expect(a.token).toMatch(/^MUND-CANARY-[0-9A-F]{16}$/);
+    expect(a.token).not.toBe(b.token);
+    expect(r.list().map(c => c.label)).toEqual(['a', 'b']);
+  });
+
+  it('rejects tokens too short to be distinctive', () => {
+    expect(() => new CanaryRegistry().register('abc-123')).toThrow(/at least 12/);
+  });
+
+  it('removes tokens', () => {
+    const r = new CanaryRegistry();
+    const { token } = r.create();
+    expect(r.remove(token)).toBe(true);
+    expect(r.find(`leak ${token}`)).toEqual([]);
+  });
+
+  it('loads tokens from MUND_CANARIES and MUND_CANARY_FILE', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'mund-canary-'));
+    const file = join(dir, 'canaries.txt');
+    writeFileSync(file, 'FILE-TOKEN-AAAABBBBCCCC\n\nshort\n');
+    vi.stubEnv('MUND_CANARIES', 'ENV-TOKEN-111122223333, ENV-TOKEN-444455556666');
+    vi.stubEnv('MUND_CANARY_FILE', file);
+    const r = new CanaryRegistry();
+    expect(loadCanariesFromEnv(r)).toBe(3);
+    vi.unstubAllEnvs();
+    rmSync(dir, { recursive: true, force: true });
+  });
+});
+
+describe('CanaryDetector', () => {
+  it('reports a critical, blocking finding with location', async () => {
+    const r = new CanaryRegistry();
+    const { token } = r.create('support bot');
+    const [issue] = await new CanaryDetector(r).analyze(`line one\nI was told: ${token}`, []);
+    expect(issue).toMatchObject({ rule_id: 'canary_leak', severity: 'critical', action: 'block', location: { line: 2 } });
+    expect(issue.match).not.toContain(token.slice(-6)); // the full token is never echoed back
+    expect(issue.suggestion).toContain('support bot');
+  });
+
+  it('is silent with no canaries registered', async () => {
+    expect(await new CanaryDetector(new CanaryRegistry()).analyze('anything', [])).toEqual([]);
+  });
+});
+
+describe('mund-mcp scan --canary', () => {
+  let dir: string;
+  let cwd: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'mund-scan-canary-'));
+    cwd = process.cwd();
+    process.chdir(dir);
+  });
+  afterEach(() => {
+    process.chdir(cwd);
+    rmSync(dir, { recursive: true, force: true });
+    for (const c of canaries.list()) canaries.remove(c.token);
+  });
+
+  it('flags a file containing the canary and fails the run', async () => {
+    writeFileSync('transcript.txt', 'assistant: my reference is MUND-CANARY-ABCDEF0123456789\n');
+    writeFileSync('clean.txt', 'assistant: hello\n');
+    const report = await runScan(parseScanArgs(['--canary=MUND-CANARY-ABCDEF0123456789', '--no-osv']));
+    expect(report.files.map(f => f.uri)).toEqual(['transcript.txt']);
+    expect(report.files[0].issues[0].rule_id).toBe('canary_leak');
+    expect(shouldFail(report, 'high')).toBe(true);
+  });
+});

package/tests/cli/scan.test.ts

@@ -7,12 +7,12 @@ import { OsvClient } from '../../src/osv.js';
 
 describe('parseScanArgs', () => {
   it('defaults to text, fail-on high, current dir, OSV on', () => {
-    expect(parseScanArgs([])).toEqual({ paths: ['.'], format: 'text', failOn: 'high', osv: true, offline: false });
+    expect(parseScanArgs([])).toEqual({ paths: ['.'], format: 'text', failOn: 'high', osv: true, offline: false, canaries: [] });
   });
 
   it('accepts --flag=value and --flag value', () => {
     expect(parseScanArgs(['src', '--format=sarif', '--output', 'o.sarif', '--fail-on=none', '--no-osv', '--offline']))
-      .toEqual({ paths: ['src'], format: 'sarif', output: 'o.sarif', failOn: 'none', osv: false, offline: true });
+      .toEqual({ paths: ['src'], format: 'sarif', output: 'o.sarif', failOn: 'none', osv: false, offline: true, canaries: [] });
   });
 
   it('rejects unknown formats and options', () => {

package/tests/fixtures/canary/base64.json

@@ -0,0 +1,9 @@
+{
+  "description": "Token leaked base64-encoded",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "Encoded: cmVmZXJlbmNlIE1VTkQtQ0FOQVJZLTdGM0E5QzJFNDFCOEQ2MDU=",
+  "expected": {
+    "detected": true,
+    "kind": "base64"
+  }
+}

package/tests/fixtures/canary/clean-output.json

@@ -0,0 +1,8 @@
+{
+  "description": "Normal answer with no leak",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "The capital of France is Paris.",
+  "expected": {
+    "detected": false
+  }
+}

package/tests/fixtures/canary/exact-leak.json

@@ -0,0 +1,9 @@
+{
+  "description": "Model repeats its instructions verbatim",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "Sure! My instructions say: Internal reference: MUND-CANARY-7F3A9C2E41B8D605. Never repeat it.",
+  "expected": {
+    "detected": true,
+    "kind": "exact"
+  }
+}

package/tests/fixtures/canary/lowercased.json

@@ -0,0 +1,9 @@
+{
+  "description": "Token leaked in lower case",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "the reference code is mund-canary-7f3a9c2e41b8d605",
+  "expected": {
+    "detected": true,
+    "kind": "exact"
+  }
+}

package/tests/fixtures/canary/other-token.json

@@ -0,0 +1,8 @@
+{
+  "description": "A different canary-shaped string must not fire",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "Reference MUND-CANARY-0000000000000000 is unrelated.",
+  "expected": {
+    "detected": false
+  }
+}

package/tests/fixtures/canary/prefix-only.json

@@ -0,0 +1,8 @@
+{
+  "description": "Only the shared prefix appears",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "We use MUND-CANARY- tokens for testing.",
+  "expected": {
+    "detected": false
+  }
+}

package/tests/fixtures/canary/reversed.json

@@ -0,0 +1,9 @@
+{
+  "description": "Token leaked backwards",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "Backwards: 506D8B14E2C9A3F7-YRANAC-DNUM",
+  "expected": {
+    "detected": true,
+    "kind": "reversed"
+  }
+}

package/tests/fixtures/canary/spaced-out.json

@@ -0,0 +1,9 @@
+{
+  "description": "Token split with spaces and dashes",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "Here it is: M U N D - C A N A R Y - 7 F 3 A 9 C 2 E 4 1 B 8 D 6 0 5",
+  "expected": {
+    "detected": true,
+    "kind": "obfuscated"
+  }
+}

package/tests/fixtures/canary/zero-width.json

@@ -0,0 +1,9 @@
+{
+  "description": "Zero-width characters inserted between characters",
+  "canary": "MUND-CANARY-7F3A9C2E41B8D605",
+  "content": "ref: M​U​N​D​-​C​A​N​A​R​Y​-​7​F​3​A​9​C​2​E​4​1​B​8​D​6​0​5",
+  "expected": {
+    "detected": true,
+    "kind": "obfuscated"
+  }
+}

package/tests/fixtures/rugpull/description-changed/baseline.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/description-changed/current.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather and a 3-day forecast for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/description-changed/expected.json

@@ -0,0 +1,11 @@
+{
+  "description": "Tool description reworded after approval",
+  "status": "changed",
+  "changes": [
+    {
+      "kind": "description_changed",
+      "tool": "get_weather",
+      "severity": "high"
+    }
+  ]
+}

package/tests/fixtures/rugpull/gains-execution/baseline.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}