@weave_protocol/mund 0.3.0 → 0.4.0

package/DETECTION_CLAIMS.md

@@ -0,0 +1,48 @@
+# Mund detection claims
+
+Every claim below is backed by a fixture in this repository and a test that checks Mund returns the stated verdict. If a claim stops holding, CI fails.
+
+```bash
+cd mund && npm ci && npx vitest run tests/preinstall.test.ts tests/fixtures.test.ts
+```
+
+Verdicts: **block** (deny), **warn** (ask the user), **allow**. All fixture content is benign: the checks look at *how* something is built (hidden characters, package names, URLs), so no real attack payloads are needed to prove them.
+
+## Skills: checked before install
+
+| Claim: Mund catches… | Fixture | Verdict |
+|---|---|---|
+| Invisible Unicode tag characters (ASCII smuggling: text the model reads but a reviewer can't see) | [`skills/hidden-tag-characters`](tests/fixtures/preinstall/skills/hidden-tag-characters/SKILL.md) | **block** |
+| Bidirectional override characters that reorder what a reviewer sees | [`skills/bidi-override`](tests/fixtures/preinstall/skills/bidi-override/SKILL.md) | **block** |
+| A credential embedded in a skill | [`skills/embedded-secret`](tests/fixtures/preinstall/skills/embedded-secret/SKILL.md) | **block** |
+| Instructions to POST data to a collection service | [`skills/exfil-url`](tests/fixtures/preinstall/skills/exfil-url/SKILL.md) | **block** |
+| `curl … \| bash` installers | [`skills/curl-bash-installer`](tests/fixtures/preinstall/skills/curl-bash-installer/SKILL.md) | warn |
+| …and leaves a plain skill alone | [`skills/clean`](tests/fixtures/preinstall/skills/clean/SKILL.md) | allow |
+
+## MCP servers: how they're launched (static, nothing is started)
+
+| Claim: Mund catches… | Fixture | Verdict |
+|---|---|---|
+| A package scope imitating `@modelcontextprotocol` | [`scope-typosquat`](tests/fixtures/preinstall/mcp-config/scope-typosquat.json) | **block** |
+| A server URL pointing at a data-collection service | [`exfil-service-url`](tests/fixtures/preinstall/mcp-config/exfil-service-url.json) | **block** |
+| A package name within two edits of a known server (`githbu`) | [`name-typosquat`](tests/fixtures/preinstall/mcp-config/name-typosquat.json) | warn |
+| A remote server over plain HTTP | [`plain-http-remote`](tests/fixtures/preinstall/mcp-config/plain-http-remote.json) | warn |
+| A token written into the config instead of `${ENV_VAR}` | [`inline-token`](tests/fixtures/preinstall/mcp-config/inline-token.json) | warn |
+| A launcher that pipes a download into a shell | [`shell-pipeline-launcher`](tests/fixtures/preinstall/mcp-config/shell-pipeline-launcher.json) | warn |
+| An unpinned package (flagged, low severity) | [`unpinned-package`](tests/fixtures/preinstall/mcp-config/unpinned-package.json) | allow |
+| …and accepts `${ENV_VAR}` references and pinned official packages | [`env-reference`](tests/fixtures/preinstall/mcp-config/env-reference.json), [`clean-pinned`](tests/fixtures/preinstall/mcp-config/clean-pinned.json) | allow |
+
+## MCP servers: live checks and rug pulls
+
+Tested against a local fake MCP server ([`fake-mcp-server.mjs`](tests/fixtures/preinstall/fake-mcp-server.mjs)) in [`tests/preinstall.test.ts`](tests/preinstall.test.ts) and [`tests/fixtures/rugpull/`](tests/fixtures/rugpull):
+
+| Claim | Verdict |
+|---|---|
+| A tool description that changes after approval (a rug pull) is flagged until you accept it | warn |
+| A rug pull that adds a command-execution tool | **block** |
+| Mund never starts a project server you haven't approved; it checks it statically | — |
+| Mund never starts a server whose package or URL it already distrusts | — |
+
+## Limits
+
+Detection is pattern-based. These claims cover the attack shapes listed, not every variant: a paraphrased instruction with no hidden characters, URL or secret won't be caught by these checks. See the [OWASP coverage tables](README.md#️-owasp-coverage) for what is and isn't covered.

package/README.md

@@ -9,7 +9,11 @@
 
 Mund (Old English: "protection, guardian") is a real-time security scanner for AI agent systems. It detects prompt injection, secrets, PII, dangerous code patterns, and data exfiltration attempts.
 
-**🆕 New in v0.2.0:** Automated threat intelligence with MITRE ATT&CK mapping and community feeds.
+**🆕 New in v0.3.1:** [Canary tokens](#-canary-tokens-system-prompt-leakage) catch leaked system prompts, and [rug-pull detection](#rug-pull-detection) flags MCP servers whose tools change after you approved them.
+
+**v0.3.0:** `mund-mcp scan` scans files on disk and outputs text, JSON, or **SARIF for GitHub code scanning**. It checks npm dependencies against **OSV.dev**, with an offline cache. Every scan gets a **0–100 risk score**, and the README adds [OWASP coverage tables](#️-owasp-coverage). This release also fixes 23 secret rules that had never matched anything.
+
+**v0.2.0:** Automated threat intelligence with MITRE ATT&CK mapping and community feeds.
 
 ## ✨ Features
 
@@ -314,6 +318,59 @@ Output: {
 
 ---
 
+### Rug-Pull Detection
+
+A rug pull is an MCP server that passes review at install time and then changes what its tools say or do. `mund_check_mcp_rugpull` records a fingerprint of every tool the first time it sees a server, then diffs every later manifest against it:
+
+| Change | Severity |
+|--------|----------|
+| Tool description changed | high |
+| Tool input schema changed | medium |
+| Tool added | medium |
+| Tool removed | low |
+| Server renamed | high |
+| Any of the above, where the changed tool now trips the MCP analyzer or newly asks for command execution | **critical** (`DO_NOT_USE`) |
+
+Re-check servers on startup or on a schedule. After a human reviews a change, pass `accept_changes: true` to update the baseline. Baselines are stored in `~/.config/mund/mcp-baselines.json` (override with `MUND_BASELINE_PATH`).
+
+## 🚪 Pre-Install Checks for Skills and MCP Servers
+
+Mund checks agent skills and MCP servers **before they get to act**. Every check is backed by a fixture; see [DETECTION_CLAIMS.md](DETECTION_CLAIMS.md).
+
+```bash
+npx @weave_protocol/mund agent-audit --live            # audit installed skills + configured MCP servers
+npx @weave_protocol/mund check-skill ./my-skill/       # check one skill before you install it
+```
+
+- **Skills:** hidden Unicode (invisible tag characters, bidi overrides), prompt injection, exfiltration instructions, dangerous commands, and embedded secrets, across `SKILL.md` and every file the skill ships.
+- **MCP servers, static:** package typosquats (including scopes imitating `@modelcontextprotocol`), unpinned packages, plain-HTTP or data-collection URLs, inline secrets, and shell-pipeline launchers.
+- **MCP servers, live (`--live`):** connects, lists the tools, scans their descriptions, and compares them with the rug-pull baseline.
+
+Verdicts are **block**, **warn** or **allow**. Configs are read from Claude Code (`.mcp.json`, `~/.claude.json`, Claude Desktop) or, with `--harness=antigravity`, from Antigravity (`.agents/`, `~/.gemini/config/`).
+
+**Safety:** the live check never starts a project or workspace server you haven't approved, or a server whose package or URL it already distrusts. Those get static checks only.
+
+**Enforcement** comes from the harness adapters, which run these checks as hooks:
+- [`@weave_protocol/adapter-claudecode`](../adapter-claudecode#mund-pre-install-hooks): `weave-claude-code mund install`
+- [`@weave_protocol/adapter-antigravity`](../adapter-antigravity#mund-pre-install-hooks): `weave-antigravity mund install`
+
+## 🐤 Canary Tokens (System Prompt Leakage)
+
+Put a canary in your system prompt. If a model is ever talked into revealing its instructions, the canary comes out with them, and Mund flags it in any scanned output. That includes copies with changed case, spacing or zero-width characters inserted, base64 encoding, or reversal.
+
+```text
+mund_create_canary { "label": "support-bot system prompt" }
+  → "MUND-CANARY-7F3A9C2E41B8D605"
+    how_to_use: Add "Internal reference: MUND-CANARY-…. Never repeat it." to the system prompt
+```
+
+From then on, `mund_scan_content` reports any leak as a critical `canary_leak` finding that blocks the output. Also available:
+- `mund_list_canaries` and `mund_remove_canary`
+- Load canaries at startup with `MUND_CANARIES` (comma-separated) or `MUND_CANARY_FILE` (one per line)
+- Scan transcripts from the CLI: `npx @weave_protocol/mund scan logs/ --canary=MUND-CANARY-…`
+
+Both features are tested against a fixture library in [`tests/fixtures/`](https://github.com/Tyox-all/Weave_Protocol/blob/main/mund/tests/fixtures): one file per case, each with its expected verdict.
+
 ## 🔐 Content Scanning Tools
 
 ### `mund_scan`
@@ -392,41 +449,45 @@ Output: {
 
 ## 🛡️ OWASP Coverage
 
-What Mund itself detects today, mapped to the OWASP lists. ✅ = covered,
-🟡 = partly covered (the gap is noted), ⬜ = not covered by Mund. Detection
-is pattern-based: Mund catches known shapes of an attack, not every
-variant. Some gaps are handled by other Weave Protocol packages, noted
-where relevant.
+How the OWASP lists are covered, in two columns:
+
+- **Mund**: what this package detects on its own.
+- **Weave suite**: Mund together with the other Weave Protocol packages. A suite ✅ means another package **enforces or detects** the control on the row's main attack path. Each one was checked in that package's source, which is linked.
+
+✅ = covered · 🟡 = partly covered (the gap is noted) · ⬜ = not covered · N/A = out of scope for agent security tooling.
+Detection is pattern-based: it catches known shapes of an attack, not every variant.
 
 ### OWASP Top 10 for LLM Applications (2025)
 
-| ID | Risk | Mund | What covers it / gap |
-|----|------|------|----------------------|
-| LLM01 | Prompt Injection | 🟡 | 4 injection patterns (instruction override, jailbreak, system-prompt extraction, role-play); MCP tool/schema/resource description injection; hidden Unicode. Novel or paraphrased injections can slip past regexes. |
-| LLM02 | Sensitive Information Disclosure | ✅ | 31 secret rules (cloud, AI-provider, VCS, payment, DB URLs, private keys), 5 PII rules, exfiltration patterns (data POSTs, DNS tunneling, encoded blobs). |
-| LLM03 | Supply Chain | 🟡 | OSV.dev CVE lookups for npm lockfiles; MCP server typosquatting, suspicious repos/URIs, unpinned versions. No model/dataset provenance; npm only. |
-| LLM04 | Data and Model Poisoning | ⬜ | Out of scope for a content scanner. |
-| LLM05 | Improper Output Handling | 🟡 | Code-pattern rules (shell/SQL injection, `rm -rf`, `curl \| bash`, base64 → exec, disabled TLS verification); `mund_validate_command`, `mund_check_url` on model output. |
-| LLM06 | Excessive Agency | 🟡 | `mund_audit_mcp_permissions` and capability analysis (execution, filesystem, network, env, DB); excessive-tool warnings. Detection only; runtime call gating is in **Hundredmen**. |
-| LLM07 | System Prompt Leakage | 🟡 | Flags system-prompt extraction attempts and secrets embedded in prompts. Does not detect a leaked prompt in output. |
-| LLM08 | Vector and Embedding Weaknesses | ⬜ | Not covered. |
-| LLM09 | Misinformation | ⬜ | Out of scope. |
-| LLM10 | Unbounded Consumption | ⬜ | Not covered. |
+| ID | Risk | Mund | Weave suite | Coverage and gaps |
+|----|------|:----:|:-----------:|-------------------|
+| LLM01 | Prompt Injection | 🟡 | 🟡 | Mund: 4 injection rules, MCP description/schema/resource injection, hidden Unicode. **Browser** adds DOM-aware IPI scanning, including hidden CSS text ([ipi.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/browser/src/ipi.ts)). Gap: paraphrased or novel injections can evade patterns. |
+| LLM02 | Sensitive Information Disclosure | ✅ | ✅ | Mund: 31 secret rules, 5 PII rules, exfiltration patterns. **Hord** adds reversible PII tokenization and redaction ([redaction/engine.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hord/src/redaction/engine.ts)). |
+| LLM03 | Supply Chain | 🟡 | ✅ | Mund: OSV.dev CVEs for npm lockfiles, MCP typosquatting. **Tollere** covers npm, PyPI, Cargo, Go and Maven CVEs, typosquats, maintainer reputation, sandwich attacks, Docker images and IDE extensions ([cve.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/tollere/src/cve.ts), [sandwich.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/tollere/src/sandwich.ts), [docker.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/tollere/src/docker.ts)). Gap: no model or dataset provenance. |
+| LLM04 | Data and Model Poisoning | N/A | N/A | Out of scope: training-time risk. |
+| LLM05 | Improper Output Handling | 🟡 | ✅ | Mund: dangerous-code rules, `mund_validate_command`, `mund_check_url`. **Hundredmen** scans every tool call's arguments before execution and blocks or holds risky ones ([interceptor.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hundredmen/src/interceptor.ts)). Gap: output rendered to a browser (XSS) isn't checked. |
+| LLM06 | Excessive Agency | 🟡 | ✅ | **Hundredmen**: approve or block per call, auto-block of high-risk calls in strict mode, approval queues by category ([interceptor.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hundredmen/src/interceptor.ts)). **Hord**: signed, expiring, scope-limited capability tokens with a delegation-depth cap ([capability/token.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hord/src/capability/token.ts)). |
+| LLM07 | System Prompt Leakage | ✅ | ✅ | Mund: **canary tokens** catch a leaked prompt in any scanned output, including spaced-out, zero-width, base64 and reversed copies ([canary.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/mund/src/canary.ts), [fixtures](https://github.com/Tyox-all/Weave_Protocol/blob/main/mund/tests/fixtures/canary)); it also flags extraction attempts and secrets inside prompts. Gap: a paraphrased leak that leaves out the canary isn't caught. |
+| LLM08 | Vector and Embedding Weaknesses | ⬜ | ⬜ | Not covered. |
+| LLM09 | Misinformation | N/A | N/A | Out of scope: content accuracy, not security. |
+| LLM10 | Unbounded Consumption | ⬜ | ✅ | **Witan**: per-window USD, token and tool-call caps that block, require approval, or notify ([spending/tracker.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/witan/src/spending/tracker.ts)), plus rate-limit and quota policies ([policy.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/witan/src/policy.ts)). |
 
 ### OWASP Top 10 for Agentic Applications
 
-| ID | Risk | Mund | What covers it / gap |
-|----|------|------|----------------------|
-| ASI01 | Agent Goal Hijack | 🟡 | Injection patterns plus MCP tool-poisoning checks on descriptions, schemas and resources. Intent-drift detection is in **Domere**. |
-| ASI02 | Tool Misuse and Exploitation | 🟡 | `mund_validate_command`, `mund_check_url`, MCP capability audit. Per-call approve/block is in **Hundredmen**. |
-| ASI03 | Identity and Privilege Abuse | 🟡 | Catches leaked credentials and over-privileged MCP servers. No identity or delegation model; capability delegation is in **Hord**. |
-| ASI04 | Agentic Supply Chain Vulnerabilities | 🟡 | Mund's strongest area: static MCP manifest scanning (tool poisoning, hidden Unicode, typosquatting, embedded secrets, suspicious sources) plus OSV dependency CVEs. Gap: no rug-pull detection (a manifest changing after install). |
-| ASI05 | Unexpected Code Execution | 🟡 | Code-pattern rules, command validation, MCP execution-capability warnings. |
-| ASI06 | Memory and Context Poisoning | 🟡 | Scans content before it enters context. No integrity checks on stored memory; vaulted memory is in **Hord**. |
-| ASI07 | Insecure Inter-Agent Communication | ⬜ | Not covered by Mund; verifiable message threads are in **Domere**. |
-| ASI08 | Cascading Failures | ⬜ | Not covered. |
-| ASI09 | Human-Agent Trust Exploitation | ⬜ | Not covered. |
-| ASI10 | Rogue Agents | ⬜ | Not covered. |
+| ID | Risk | Mund | Weave suite | Coverage and gaps |
+|----|------|:----:|:-----------:|-------------------|
+| ASI01 | Agent Goal Hijack | 🟡 | 🟡 | Mund: injection and MCP tool-poisoning checks. **Hundredmen** and **Domere** flag drift from the declared intent ([thread/drift.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/domere/src/thread/drift.ts)). Gap: drift is scored by word overlap, not meaning, so a reworded hijack can pass. |
+| ASI02 | Tool Misuse and Exploitation | 🟡 | ✅ | **Hundredmen** intercepts every MCP tool call: argument scanning, server reputation, intent analysis, then approve, block or hold for review ([interceptor.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hundredmen/src/interceptor.ts)). |
+| ASI03 | Identity and Privilege Abuse | 🟡 | ✅ | **Hord**: HMAC-signed capability tokens with expiry, revocation and a delegation-depth cap ([capability/token.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hord/src/capability/token.ts)). **Domere**: signed handoff tokens bound to one agent, with expiry and revocation ([handoff/verification.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/domere/src/handoff/verification.ts)). Mund catches leaked credentials. |
+| ASI04 | Agentic Supply Chain Vulnerabilities | ✅ | ✅ | Mund: static MCP manifest scanning, OSV CVEs, and **rug-pull detection**, which baselines every tool and escalates changes that turn malicious ([rugpull.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/mund/src/rugpull.ts), [fixtures](https://github.com/Tyox-all/Weave_Protocol/blob/main/mund/tests/fixtures/rugpull)). **Tollere**: package, container and extension supply chain. |
+| ASI05 | Unexpected Code Execution | 🟡 | 🟡 | Mund: dangerous-code rules and command validation. **Hundredmen** can block or hold execution calls. Gap: **Hord**'s sandbox enforces a timeout and a temp working directory, but not memory, network or filesystem isolation ([sandbox/executor.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hord/src/sandbox/executor.ts)). |
+| ASI06 | Memory and Context Poisoning | 🟡 | 🟡 | Mund scans content before it enters context, and **Hord** stores memory encrypted. Gap: stored memory isn't scanned on write or integrity-checked. |
+| ASI07 | Insecure Inter-Agent Communication | ⬜ | ✅ | **Domere**: handoffs carry a signed token with an intent hash, are bound to the receiving agent, and expire or can be revoked ([handoff/verification.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/domere/src/handoff/verification.ts)). |
+| ASI08 | Cascading Failures | ⬜ | 🟡 | **Witan**: checkpoints, transaction rollback and recovery plans ([recovery.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/witan/src/recovery.ts)). Gap: recovers after failure; no circuit breaker to contain one. |
+| ASI09 | Human-Agent Trust Exploitation | ⬜ | ⬜ | Not covered. |
+| ASI10 | Rogue Agents | ⬜ | 🟡 | **Hord**: signed, hash-chained attestations of agent actions ([attestation/service.ts](https://github.com/Tyox-all/Weave_Protocol/blob/main/hord/src/attestation/service.ts)). **Hundredmen** monitors and can block calls. Gap: no behavioral baseline to spot a rogue agent automatically. |
+
+**Totals:** Mund alone has **3 ✅** out of 20; the Weave suite has **10 ✅**. Next on the path to more green: injection detection measured against Adversary's corpus (LLM01 / ASI01), real sandbox isolation in Hord (ASI05), and scanning memory on write (ASI06).
 
 ---
 

package/dist/agent-audit.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Mund - The Guardian Protocol
+ * Agent audit: pre-install checks for skills and MCP servers
+ *
+ * Backs the "pre-install" hooks in the Weave Protocol harness adapters:
+ *
+ *   - Skills: scan SKILL.md and every text file in a skill directory for
+ *     prompt injection, exfiltration, dangerous code, secrets and hidden
+ *     Unicode (invisible "tag" characters can smuggle instructions that a
+ *     human reviewer never sees).
+ *   - MCP servers: static checks on how each configured server is launched
+ *     (package typosquats, unpinned packages, insecure or exfil URLs, inline
+ *     secrets), plus an optional live check that connects, lists the tools,
+ *     scans their descriptions, and compares them with the rug-pull baseline.
+ *
+ * SAFETY: the live check starts server processes. It only does that for
+ * servers the user configured themselves (user/local scope) or explicitly
+ * approved for this project. Project `.mcp.json` servers that Claude Code
+ * would still ask about are checked statically only, so opening a
+ * malicious repository never runs its servers through Mund.
+ */
+import type { SecurityIssue } from './types.js';
+import { type McpServerManifest } from './analyzers/mcp-server-analyzer.js';
+import { type RiskScore } from './scoring.js';
+import { BaselineStore, type RugPullResult } from './rugpull.js';
+export type Verdict = 'allow' | 'warn' | 'block';
+/** Which agent harness's config layout to audit. */
+export type Harness = 'claude' | 'antigravity';
+export interface SkillAudit {
+    name: string;
+    path: string;
+    scope: 'project' | 'user' | 'workspace' | 'global' | 'plugin';
+    verdict: Verdict;
+    risk: RiskScore;
+    issues: SecurityIssue[];
+}
+export interface McpServerConfig {
+    type?: string;
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    url?: string;
+    /** Antigravity spelling of url */
+    serverUrl?: string;
+    headers?: Record<string, string>;
+    disabled?: boolean;
+}
+export interface McpServerAudit {
+    name: string;
+    scope: 'project' | 'local' | 'user' | 'desktop' | 'workspace' | 'global';
+    transport: 'stdio' | 'http' | 'sse' | 'unknown';
+    target: string;
+    verdict: Verdict;
+    risk: RiskScore;
+    issues: SecurityIssue[];
+    live: {
+        status: 'ok' | 'error' | 'skipped';
+        reason?: string;
+        tools?: number;
+        rugpull?: RugPullResult['status'];
+    };
+}
+export interface AgentAuditReport {
+    version: 1;
+    tool: {
+        name: 'mund';
+        version: string;
+    };
+    generatedAt: string;
+    cwd: string;
+    servers: McpServerAudit[];
+    skills: SkillAudit[];
+    summary: Record<Verdict, number>;
+}
+/**
+ * critical → block; high in a blocking category (injection, exfiltration,
+ * hidden Unicode) → block; other high/medium → warn; else allow.
+ */
+export declare function verdictFor(issues: Array<Pick<SecurityIssue, 'severity' | 'type'>>): Verdict;
+/** Scan one piece of skill content (a SKILL.md or a file shipped with the skill). */
+export declare function scanSkillContent(content: string): Promise<SecurityIssue[]>;
+export declare function scanSkillDir(dir: string, scope?: SkillAudit['scope']): Promise<SkillAudit>;
+export declare function skillRoots(cwd: string, home?: string, harness?: Harness): Array<[string, SkillAudit['scope']]>;
+export declare function discoverSkillDirs(cwd: string, home?: string, harness?: Harness): Array<{
+    dir: string;
+    scope: SkillAudit['scope'];
+}>;
+interface DiscoveredServer {
+    name: string;
+    scope: McpServerAudit['scope'];
+    config: McpServerConfig;
+    /** Started by the user's own configuration or explicitly approved; safe to start for a live check. */
+    approved: boolean;
+}
+/** Claude Desktop's config, which also supplies MCP servers to its Code tab. */
+export declare function claudeDesktopConfigPath(home?: string): string;
+/**
+ * Claude Code MCP config: <cwd>/.mcp.json (project), ~/.claude.json (user +
+ * per-project local), and Claude Desktop's claude_desktop_config.json.
+ */
+export declare function discoverMcpServers(cwd: string, home?: string): DiscoveredServer[];
+/**
+ * Antigravity MCP config: <workspace>/.agents/mcp_config.json and
+ * ~/.gemini/config/mcp_config.json. Workspace servers are checked
+ * statically only (same consent rule as Claude Code project servers);
+ * servers marked "disabled" are never started.
+ */
+export declare function discoverAntigravityMcpServers(cwd: string, home?: string): DiscoveredServer[];
+/** The package a launcher like `npx -y pkg@1.2.3` runs, if any. */
+export declare function launchedPackage(config: McpServerConfig): {
+    name: string;
+    version?: string;
+} | null;
+/** Static checks on how a server is launched. No processes are started. */
+export declare function checkMcpServerConfig(name: string, config: McpServerConfig): Promise<SecurityIssue[]>;
+/** Connect to a server, list its tools, and return them as a manifest. */
+export declare function fetchLiveManifest(name: string, config: McpServerConfig, timeoutMs?: number): Promise<McpServerManifest>;
+export declare function calibrateLiveFindings(issues: SecurityIssue[]): SecurityIssue[];
+export declare function auditMcpServer(server: DiscoveredServer, opts?: {
+    live?: boolean;
+    store?: BaselineStore;
+    timeoutMs?: number;
+    accept?: string[];
+    harness?: Harness;
+}): Promise<McpServerAudit>;
+/** Cache key: sha256(resolved cwd), plus the harness for non-Claude layouts. */
+export declare function auditCachePath(cwd: string, harness?: Harness): string;
+export declare function runAgentAudit(opts?: {
+    cwd?: string;
+    live?: boolean;
+    home?: string;
+    store?: BaselineStore;
+    timeoutMs?: number;
+    writeCache?: boolean;
+    accept?: string[];
+    harness?: Harness;
+}): Promise<AgentAuditReport>;
+export {};
+//# sourceMappingURL=agent-audit.d.ts.map

package/dist/agent-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-audit.d.ts","sourceRoot":"","sources":["../src/agent-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,YAAY,CAAC;AAI1D,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,aAAa,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhG,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,oDAAoD;AACpD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE/C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACzE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,IAAI,EAAE;QAAE,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CAClH;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAClC;AAQD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,OAAO,CAO3F;AAmCD,qFAAqF;AACrF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEhF;AAaD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,UAAU,CAAC,OAAO,CAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAU3G;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,EAAE,OAAO,GAAE,OAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAgB3H;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,EAAE,OAAO,GAAE,OAAkB,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAUhJ;AAMD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,eAAe,CAAC;IACxB,sGAAsG;IACtG,QAAQ,EAAE,OAAO,CAAC;CACnB;AAUD,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,IAAI,SAAY,GAAG,MAAM,CAIhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,gBAAgB,EAAE,CA4BpF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,gBAAgB,EAAE,CAW/F;AAmBD,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUlG;AAMD,2EAA2E;AAC3E,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CA2D1G;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoC3H;AAaD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAI9E;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7G,OAAO,CAAC,cAAc,CAAC,CAwCzB;AAMD,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,OAAkB,GAAG,MAAM,CAI/E;AAED,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiBhO"}