@weave_protocol/mund 0.3.0 → 0.4.0

package/dist/canary.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary Tokens - detect system prompt leakage (OWASP LLM07)
+ *
+ * Generate a unique marker, place it in your system prompt (or any
+ * confidential context), and Mund flags any scanned output that
+ * contains it. A model that has been talked into revealing its
+ * instructions reveals the canary with them.
+ *
+ * Matching tolerates the cheap evasions a leaking model or an attacker
+ * might apply: case changes, inserted whitespace / zero-width
+ * characters / punctuation, base64 encoding, and reversal.
+ */
+import type { DetectionRule, IAnalyzer, SecurityIssue } from './types.js';
+export interface Canary {
+    token: string;
+    label: string;
+    createdAt: string;
+}
+export type CanaryMatchKind = 'exact' | 'obfuscated' | 'base64' | 'reversed';
+export declare class CanaryRegistry {
+    private canaries;
+    /** Create a new random canary token. */
+    create(label?: string): Canary;
+    /** Register an existing token (e.g. one already deployed in a prompt). */
+    register(token: string, label?: string): Canary;
+    remove(token: string): boolean;
+    list(): Canary[];
+    get size(): number;
+    /** Find every registered canary that appears in the content. */
+    find(content: string): Array<{
+        canary: Canary;
+        kind: CanaryMatchKind;
+        index: number;
+    }>;
+}
+/** Shared registry used by the MCP tools and the default analyzer set. */
+export declare const canaries: CanaryRegistry;
+/** Load canaries from MUND_CANARIES (comma-separated) or MUND_CANARY_FILE (one per line). */
+export declare function loadCanariesFromEnv(registry?: CanaryRegistry): number;
+export declare class CanaryDetector implements IAnalyzer {
+    private registry;
+    name: string;
+    type: string;
+    constructor(registry?: CanaryRegistry);
+    analyze(content: string, _rules: DetectionRule[]): Promise<SecurityIssue[]>;
+}
+//# sourceMappingURL=canary.d.ts.map

package/dist/canary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.d.ts","sourceRoot":"","sources":["../src/canary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAW7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAA6B;IAE7C,wCAAwC;IACxC,MAAM,CAAC,KAAK,SAAkB,GAAG,MAAM;IAUvC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAkB,GAAG,MAAM;IASxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9B,IAAI,IAAI,MAAM,EAAE;IAIhB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,gEAAgE;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAwBvF;AAiBD,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,gBAAuB,CAAC;AAE7C,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,cAAyB,GAAG,MAAM,CAoB/E;AAED,qBAAa,cAAe,YAAW,SAAS;IAIlC,OAAO,CAAC,QAAQ;IAH5B,IAAI,SAAoB;IACxB,IAAI,SAAkB;gBAEF,QAAQ,GAAE,cAAyB;IAEjD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAmBlF"}

package/dist/canary.js

@@ -0,0 +1,149 @@
+/**
+ * Mund - The Guardian Protocol
+ * Canary Tokens - detect system prompt leakage (OWASP LLM07)
+ *
+ * Generate a unique marker, place it in your system prompt (or any
+ * confidential context), and Mund flags any scanned output that
+ * contains it. A model that has been talked into revealing its
+ * instructions reveals the canary with them.
+ *
+ * Matching tolerates the cheap evasions a leaking model or an attacker
+ * might apply: case changes, inserted whitespace / zero-width
+ * characters / punctuation, base64 encoding, and reversal.
+ */
+import { randomBytes } from 'crypto';
+import { readFileSync } from 'fs';
+const TOKEN_PREFIX = 'MUND-CANARY-';
+const MIN_TOKEN_LENGTH = 12;
+const ZERO_WIDTH = /[​-‍⁠]/g;
+/** Lowercase and keep only letters and digits. */
+function squash(text) {
+    return text.replace(ZERO_WIDTH, '').toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+export class CanaryRegistry {
+    canaries = new Map();
+    /** Create a new random canary token. */
+    create(label = 'system-prompt') {
+        const canary = {
+            token: TOKEN_PREFIX + randomBytes(8).toString('hex').toUpperCase(),
+            label,
+            createdAt: new Date().toISOString(),
+        };
+        this.canaries.set(canary.token, canary);
+        return canary;
+    }
+    /** Register an existing token (e.g. one already deployed in a prompt). */
+    register(token, label = 'system-prompt') {
+        if (squash(token).length < MIN_TOKEN_LENGTH) {
+            throw new Error(`Canary token must contain at least ${MIN_TOKEN_LENGTH} letters/digits to avoid false positives`);
+        }
+        const canary = { token, label, createdAt: new Date().toISOString() };
+        this.canaries.set(token, canary);
+        return canary;
+    }
+    remove(token) {
+        return this.canaries.delete(token);
+    }
+    list() {
+        return [...this.canaries.values()];
+    }
+    get size() {
+        return this.canaries.size;
+    }
+    /** Find every registered canary that appears in the content. */
+    find(content) {
+        const hits = [];
+        if (this.canaries.size === 0 || !content)
+            return hits;
+        const lower = content.toLowerCase();
+        const squashed = squash(content);
+        const decoded = decodeBase64Runs(content).map(squash);
+        for (const canary of this.canaries.values()) {
+            const needle = squash(canary.token);
+            const exactAt = lower.indexOf(canary.token.toLowerCase());
+            if (exactAt !== -1) {
+                hits.push({ canary, kind: 'exact', index: exactAt });
+            }
+            else if (squashed.includes(needle)) {
+                hits.push({ canary, kind: 'obfuscated', index: -1 });
+            }
+            else if (decoded.some(d => d.includes(needle))) {
+                hits.push({ canary, kind: 'base64', index: -1 });
+            }
+            else if (squashed.includes([...needle].reverse().join(''))) {
+                hits.push({ canary, kind: 'reversed', index: -1 });
+            }
+        }
+        return hits;
+    }
+}
+/** Decode every plausible base64 run in the text (best effort). */
+function decodeBase64Runs(content) {
+    const runs = content.match(/[A-Za-z0-9+/]{16,}={0,2}/g) ?? [];
+    const out = [];
+    for (const run of runs) {
+        try {
+            const text = Buffer.from(run, 'base64').toString('utf8');
+            if (/^[\x20-\x7E\s]+$/.test(text))
+                out.push(text);
+        }
+        catch {
+            // not base64
+        }
+    }
+    return out;
+}
+/** Shared registry used by the MCP tools and the default analyzer set. */
+export const canaries = new CanaryRegistry();
+/** Load canaries from MUND_CANARIES (comma-separated) or MUND_CANARY_FILE (one per line). */
+export function loadCanariesFromEnv(registry = canaries) {
+    const tokens = [];
+    if (process.env.MUND_CANARIES)
+        tokens.push(...process.env.MUND_CANARIES.split(','));
+    if (process.env.MUND_CANARY_FILE) {
+        try {
+            tokens.push(...readFileSync(process.env.MUND_CANARY_FILE, 'utf8').split('\n'));
+        }
+        catch {
+            // missing file: nothing to load
+        }
+    }
+    let loaded = 0;
+    for (const t of tokens.map(t => t.trim()).filter(Boolean)) {
+        try {
+            registry.register(t, 'env');
+            loaded++;
+        }
+        catch {
+            // too short; skip
+        }
+    }
+    return loaded;
+}
+export class CanaryDetector {
+    registry;
+    name = 'CanaryDetector';
+    type = 'exfiltration';
+    constructor(registry = canaries) {
+        this.registry = registry;
+    }
+    async analyze(content, _rules) {
+        return this.registry.find(content).map(({ canary, kind, index }) => {
+            const before = index >= 0 ? content.slice(0, index).split('\n') : null;
+            return {
+                rule_id: 'canary_leak',
+                rule_name: `Canary token leaked (${kind})`,
+                type: 'exfiltration',
+                severity: 'critical',
+                action: 'block',
+                match: `${canary.token.slice(0, TOKEN_PREFIX.length + 4)}…`,
+                ...(before
+                    ? { location: { start: index, end: index + canary.token.length, line: before.length, column: before[before.length - 1].length + 1 } }
+                    : {}),
+                suggestion: `Content contains the "${canary.label}" canary, so confidential instructions or context are leaking. ` +
+                    'Block this output and review the prompt that produced it.',
+            };
+        });
+    }
+}
+//# sourceMappingURL=canary.js.map

package/dist/canary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.js","sourceRoot":"","sources":["../src/canary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAWlC,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,kDAAkD;AAClD,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,wCAAwC;IACxC,MAAM,CAAC,KAAK,GAAG,eAAe;QAC5B,MAAM,MAAM,GAAW;YACrB,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YAClE,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,QAAQ,CAAC,KAAa,EAAE,KAAK,GAAG,eAAe;QAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sCAAsC,gBAAgB,0CAA0C,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAW,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,OAAe;QAClB,MAAM,IAAI,GAAoE,EAAE,CAAC;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEtD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAE1D,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,WAA2B,QAAQ;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,cAAc;IAIL;IAHpB,IAAI,GAAG,gBAAgB,CAAC;IACxB,IAAI,GAAG,cAAc,CAAC;IAEtB,YAAoB,WAA2B,QAAQ;QAAnC,aAAQ,GAAR,QAAQ,CAA2B;IAAG,CAAC;IAE3D,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,MAAuB;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACjE,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,SAAS,EAAE,wBAAwB,IAAI,GAAG;gBAC1C,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG;gBAC3D,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE;oBACrI,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EACR,yBAAyB,MAAM,CAAC,KAAK,iEAAiE;oBACtG,2DAA2D;aAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/cli/agent.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Mund - The Guardian Protocol
+ * `mund-mcp agent-audit` and `mund-mcp check-skill`: pre-install checks
+ * used by the Weave Protocol harness adapters.
+ */
+export declare const AGENT_USAGE = "Usage:\n  mund-mcp agent-audit [--cwd=DIR] [--live] [--json] [--fail-on=block|warn|none] [--timeout=MS]\n                      [--accept-changes=NAME[,NAME\u2026]|all] [--harness=claude|antigravity]\n      Audit installed skills and configured MCP servers (Claude Code layout).\n      --live connects to approved servers, scans their tool descriptions and\n      checks them against the rug-pull baseline. Writes a verdict cache used\n      by the harness hooks. --accept-changes re-baselines servers whose tool\n      changes you have reviewed.\n\n  mund-mcp check-skill <SKILL.md | skill-dir | -> [--json]\n      Scan one skill before installing it. \"-\" reads content from stdin.\n      Exit code 1 means \"block\".\n";
+export declare function runAgentAuditCli(args: string[]): Promise<number>;
+export declare function runCheckSkillCli(args: string[]): Promise<number>;
+//# sourceMappingURL=agent.d.ts.map

package/dist/cli/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/cli/agent.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,eAAO,MAAM,WAAW,stBAYvB,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBtE;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBtE"}

package/dist/cli/agent.js

@@ -0,0 +1,91 @@
+/**
+ * Mund - The Guardian Protocol
+ * `mund-mcp agent-audit` and `mund-mcp check-skill`: pre-install checks
+ * used by the Weave Protocol harness adapters.
+ */
+import { readFileSync, statSync } from 'fs';
+import { resolve } from 'path';
+import { runAgentAudit, scanSkillContent, scanSkillDir, verdictFor } from '../agent-audit.js';
+import { computeRiskScore } from '../scoring.js';
+const flag = (args, name) => {
+    const hit = args.find((a) => a === `--${name}` || a.startsWith(`--${name}=`));
+    if (!hit)
+        return undefined;
+    return hit.includes('=') ? hit.slice(hit.indexOf('=') + 1) : true;
+};
+const RANK = { allow: 0, warn: 1, block: 2 };
+export const AGENT_USAGE = `Usage:
+  mund-mcp agent-audit [--cwd=DIR] [--live] [--json] [--fail-on=block|warn|none] [--timeout=MS]
+                      [--accept-changes=NAME[,NAME…]|all] [--harness=claude|antigravity]
+      Audit installed skills and configured MCP servers (Claude Code layout).
+      --live connects to approved servers, scans their tool descriptions and
+      checks them against the rug-pull baseline. Writes a verdict cache used
+      by the harness hooks. --accept-changes re-baselines servers whose tool
+      changes you have reviewed.
+
+  mund-mcp check-skill <SKILL.md | skill-dir | -> [--json]
+      Scan one skill before installing it. "-" reads content from stdin.
+      Exit code 1 means "block".
+`;
+export async function runAgentAuditCli(args) {
+    if (flag(args, 'help')) {
+        process.stdout.write(AGENT_USAGE);
+        return 0;
+    }
+    const timeout = Number(flag(args, 'timeout') ?? 8000);
+    const accept = typeof flag(args, 'accept-changes') === 'string' ? String(flag(args, 'accept-changes')).split(',') : undefined;
+    const harness = flag(args, 'harness') === 'antigravity' ? 'antigravity' : 'claude';
+    const report = await runAgentAudit({ cwd: flag(args, 'cwd') || process.cwd(), live: !!flag(args, 'live') || !!accept, timeoutMs: timeout, accept, harness });
+    if (flag(args, 'json')) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    }
+    else {
+        const icon = { allow: '✓', warn: '!', block: '✗' };
+        for (const s of report.servers) {
+            const live = s.live.status === 'ok' ? `${s.live.tools} tools, baseline ${s.live.rugpull}` : `live ${s.live.status}${s.live.reason ? `: ${s.live.reason}` : ''}`;
+            console.log(`${icon[s.verdict]} MCP  ${s.name} (${s.scope}) ${s.verdict.toUpperCase()} · ${live}`);
+            for (const i of s.issues.filter((x) => x.severity !== 'info'))
+                console.log(`      ${i.severity.padEnd(8)} ${i.rule_name}`);
+        }
+        for (const k of report.skills) {
+            console.log(`${icon[k.verdict]} SKILL ${k.name} (${k.scope}) ${k.verdict.toUpperCase()} · risk ${k.risk.score}/100`);
+            for (const i of k.issues.filter((x) => x.severity !== 'info' && x.severity !== 'low'))
+                console.log(`      ${i.severity.padEnd(8)} ${i.rule_name}`);
+        }
+        console.log(`\n${report.servers.length} MCP server(s), ${report.skills.length} skill(s): ${report.summary.block} block, ${report.summary.warn} warn, ${report.summary.allow} allow`);
+    }
+    const failOn = flag(args, 'fail-on') || 'block';
+    if (failOn === 'none')
+        return 0;
+    const worst = [...report.servers, ...report.skills].reduce((w, x) => Math.max(w, RANK[x.verdict]), 0);
+    return worst >= RANK[failOn] ? 1 : 0;
+}
+export async function runCheckSkillCli(args) {
+    const target = args.find((a) => !a.startsWith('--'));
+    if (!target || flag(args, 'help')) {
+        process.stdout.write(AGENT_USAGE);
+        return target ? 0 : 2;
+    }
+    let result;
+    if (target === '-') {
+        const issues = await scanSkillContent(readFileSync(0, 'utf8'));
+        result = { verdict: verdictFor(issues), risk: computeRiskScore(issues), issues };
+    }
+    else if (statSync(resolve(target)).isDirectory()) {
+        const r = await scanSkillDir(resolve(target));
+        result = { verdict: r.verdict, risk: r.risk, issues: r.issues };
+    }
+    else {
+        const issues = await scanSkillContent(readFileSync(resolve(target), 'utf8'));
+        result = { verdict: verdictFor(issues), risk: computeRiskScore(issues), issues };
+    }
+    if (flag(args, 'json'))
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+    else {
+        console.log(`${result.verdict.toUpperCase()} · risk ${result.risk.score}/100 (${result.risk.label})`);
+        for (const i of result.issues)
+            console.log(`  ${i.severity.padEnd(8)} ${i.rule_name}`);
+    }
+    return result.verdict === 'block' ? 1 : 0;
+}
+//# sourceMappingURL=agent.js.map

package/dist/cli/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/cli/agent.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAC5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,IAAY,EAAE,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC,CAAC;AACF,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;CAY1B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAY,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACzK,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAChK,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YACnG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;YACrH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,OAAO,CAAC,KAAK,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,UAAU,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvL,CAAC;IACD,MAAM,MAAM,GAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAY,IAAI,OAAO,CAAC;IAC5D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtG,OAAO,KAAK,IAAI,IAAI,CAAC,MAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAChG,IAAI,MAA6H,CAAC;IAClI,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;SAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;SAChF,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACtG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/cli/scan.d.ts

@@ -19,6 +19,7 @@ export interface ScanCliOptions {
     failOn: FailOn;
     osv: boolean;
     offline: boolean;
+    canaries: string[];
 }
 export interface FileReport extends SarifTarget {
     risk: RiskScore;
@@ -38,7 +39,7 @@ export interface ScanReport {
     };
     files: FileReport[];
 }
-export declare const SCAN_USAGE = "Usage: mund-mcp scan [paths...] [options]\n\nScan files for secrets, PII, injection, exfiltration and dangerous code,\nplus known-vulnerable npm dependencies (via OSV.dev) in package-lock.json.\n\nOptions:\n  --format=FORMAT    text (default), json, or sarif\n  --output=FILE      Write the report to FILE instead of stdout\n  --fail-on=LEVEL    Exit 1 if any finding is at or above LEVEL\n                     (critical, high [default], medium, low, none)\n  --no-osv           Skip dependency vulnerability lookups\n  --offline          Use only the local OSV cache (also: MUND_OFFLINE=1)\n\nExamples:\n  mund-mcp scan .\n  mund-mcp scan src --format=sarif --output=mund.sarif\n";
+export declare const SCAN_USAGE = "Usage: mund-mcp scan [paths...] [options]\n\nScan files for secrets, PII, injection, exfiltration and dangerous code,\nplus known-vulnerable npm dependencies (via OSV.dev) in package-lock.json.\n\nOptions:\n  --format=FORMAT    text (default), json, or sarif\n  --output=FILE      Write the report to FILE instead of stdout\n  --fail-on=LEVEL    Exit 1 if any finding is at or above LEVEL\n                     (critical, high [default], medium, low, none)\n  --no-osv           Skip dependency vulnerability lookups\n  --offline          Use only the local OSV cache (also: MUND_OFFLINE=1)\n  --canary=TOKEN     Flag any file containing this canary token (repeatable;\n                     also MUND_CANARIES / MUND_CANARY_FILE)\n\nExamples:\n  mund-mcp scan .\n  mund-mcp scan src --format=sarif --output=mund.sarif\n";
 export declare function parseScanArgs(args: string[]): ScanCliOptions;
 export declare function runScan(opts: ScanCliOptions, osvClient?: OsvClient): Promise<ScanReport>;
 export declare function formatReport(report: ScanReport, format: OutputFormat): string;

package/dist/cli/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAwC,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAG5F,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AACrD,KAAK,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAOD,eAAO,MAAM,UAAU,6qBAgBtB,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CA2C5D;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAqD9F;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAwB7E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAItE;AAED,sEAAsE;AACtE,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBhE"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAwC,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAI5F,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AACrD,KAAK,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAOD,eAAO,MAAM,UAAU,wzBAkBtB,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CA8C5D;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAuD9F;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAwB7E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAItE;AAED,sEAAsE;AACtE,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBhE"}

package/dist/cli/scan.js

@@ -14,6 +14,7 @@ import { computeRiskScore } from '../scoring.js';
 import { toSarif } from '../sarif.js';
 import { OsvClient, parseNpmLockfile, advisoriesToIssues } from '../osv.js';
 import { getVersion } from '../version.js';
+import { canaries, loadCanariesFromEnv } from '../canary.js';
 const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.next', '.turbo', 'vendor', '__pycache__', '.venv']);
 const LOCKFILES = new Set(['package-lock.json', 'npm-shrinkwrap.json']);
 const MAX_FILE_BYTES = 1024 * 1024;
@@ -30,13 +31,15 @@ Options:
                      (critical, high [default], medium, low, none)
   --no-osv           Skip dependency vulnerability lookups
   --offline          Use only the local OSV cache (also: MUND_OFFLINE=1)
+  --canary=TOKEN     Flag any file containing this canary token (repeatable;
+                     also MUND_CANARIES / MUND_CANARY_FILE)
 
 Examples:
   mund-mcp scan .
   mund-mcp scan src --format=sarif --output=mund.sarif
 `;
 export function parseScanArgs(args) {
-    const opts = { paths: [], format: 'text', failOn: 'high', osv: true, offline: false };
+    const opts = { paths: [], format: 'text', failOn: 'high', osv: true, offline: false, canaries: [] };
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         const [flag, inline] = arg.startsWith('--') && arg.includes('=') ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)] : [arg, undefined];
@@ -71,6 +74,9 @@ export function parseScanArgs(args) {
             case '--offline':
                 opts.offline = true;
                 break;
+            case '--canary':
+                opts.canaries.push(value());
+                break;
             default:
                 if (flag.startsWith('-'))
                     throw new Error(`Unknown option ${flag}`);
@@ -83,6 +89,9 @@ export function parseScanArgs(args) {
 }
 export async function runScan(opts, osvClient) {
     const cwd = process.cwd();
+    loadCanariesFromEnv();
+    for (const token of opts.canaries)
+        canaries.register(token, 'cli');
     const engine = new AnalyzerEngine();
     const files = [];
     const lockfiles = [];

package/dist/cli/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAkB,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AA0B3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AACtI,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACxE,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAErG,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;CAgBzB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,MAAM,IAAI,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEtG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxJ,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;gBAC3H,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC;YAChB,KAAK,IAAI;gBACP,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACtB,MAAM;YACR,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;gBAC7F,IAAI,CAAC,MAAM,GAAG,CAAW,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,UAAU;gBACb,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,SAAqB;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACpC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,OAAO,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,GAAsB,CAAC;IAC3B,IAAI,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,GAAc,MAAM,CAAC;QAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAyB,CAAC;QAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,yCAAyC;YACrD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,8CAA8C;YAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChH,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YACrC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;YAEvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpD,aAAa,EAAE,OAAO;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,MAAoB;IACnE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,aAAa,aAAa,KAAK,cAAc;QACxE,IAAI,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/G,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,MAAc;IAC3D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAe,KAAe,CAAC,OAAO,OAAO,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAe;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAkB,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA2B7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AACtI,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACxE,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAErG,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;CAkBzB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,MAAM,IAAI,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEpH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxJ,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;gBAC3H,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC;YAChB,KAAK,IAAI;gBACP,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACtB,MAAM;YACR,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;gBAC7F,IAAI,CAAC,MAAM,GAAG,CAAW,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,UAAU;gBACb,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC5B,MAAM;YACR;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,SAAqB;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,mBAAmB,EAAE,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACpC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,OAAO,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,GAAsB,CAAC;IAC3B,IAAI,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,GAAc,MAAM,CAAC;QAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAyB,CAAC;QAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,yCAAyC;YACrD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,8CAA8C;YAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChH,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YACrC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;YAEvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpD,aAAa,EAAE,OAAO;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,MAAoB;IACnE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,aAAa,aAAa,KAAK,cAAc;QACxE,IAAI,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/G,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,MAAc;IAC3D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAe,KAAe,CAAC,OAAO,OAAO,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAe;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAwXH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAmYH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -13,7 +13,9 @@ import { AnalyzerEngine } from './analyzers/index.js';
 import { NotificationHub } from './notifications/index.js';
 import { registerAllTools } from './tools/index.js';
 import { runScanCli } from './cli/scan.js';
+import { runAgentAuditCli, runCheckSkillCli } from './cli/agent.js';
 import { getVersion } from './version.js';
+import { loadCanariesFromEnv } from './canary.js';
 // Threat Intelligence imports
 import { threatIntel } from './threat-intel-manager.js';
 import { threatIntelTools, createThreatIntelToolHandlers, UpdateThreatIntelSchema, ListIntelSourcesSchema, IntelStatusSchema, AddIntelSourceSchema, RemoveIntelSourceSchema, ThreatScanSchema, ListPatternsSchema, TogglePatternSchema, } from './threat-intel-tools.js';
@@ -137,6 +139,7 @@ async function createMundServer(config) {
         }
     }
     // Register all core tools
+    loadCanariesFromEnv();
     registerAllTools(server, storage, rules, analyzer, notificationHub, config.block_mode);
     // Register threat intelligence tools
     registerThreatIntelTools(server);
@@ -198,6 +201,8 @@ MCP-based security monitoring for agentic AI systems
 
 Usage: mund-mcp [options]          Run the MCP server
        mund-mcp scan [paths...]    Scan files (see: mund-mcp scan --help)
+       mund-mcp agent-audit        Audit installed skills + MCP servers
+       mund-mcp check-skill <path> Scan a skill before installing it
 
 Options:
   --help, -h          Show this help message
@@ -258,6 +263,12 @@ async function main() {
     if (args[0] === 'scan') {
         process.exit(await runScanCli(args.slice(1)));
     }
+    if (args[0] === 'agent-audit') {
+        process.exit(await runAgentAuditCli(args.slice(1)));
+    }
+    if (args[0] === 'check-skill') {
+        process.exit(await runCheckSkillCli(args.slice(1)));
+    }
     // Parse CLI arguments
     if (args.includes('--help') || args.includes('-h')) {
         printHelp();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,8BAA8B;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,SAAS,UAAU;IACjB,MAAM,MAAM,GAAe;QACzB,GAAG,cAAc;QAEjB,mCAAmC;QACnC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QAC/C,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW;QAC1C,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,cAAmC,IAAI,OAAO;QAEtE,UAAU;QACV,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,cAA0C,IAAI,MAAM;QAE5E,UAAU;QACV,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,YAA2C,IAAI,QAAQ;QAClF,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAE3C,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,OAAO;QACnD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QAEjC,gBAAgB;QAChB,aAAa,EAAE;YACb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe;gBAC5D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO;gBACnD,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,KAAK,CAAC;gBAC9D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;gBAC1D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB;gBAC7D,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC1E,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACxC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACjC,MAAM,EAAE,MAAe;oBACvB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;oBACpG,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,yBAA6E,IAAI,MAAM;iBACnH,CAAC,CAAC,CAAC,CAAC,SAAS;SACf;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,SAAS,wBAAwB,CAAC,MAAiB;IACjD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAE5D,4BAA4B;IAC5B,MAAM,SAAS,GAAwC;QACrD,0BAA0B,EAAE,uBAAuB;QACnD,yBAAyB,EAAE,sBAAsB;QACjD,mBAAmB,EAAE,iBAAiB;QACtC,uBAAuB,EAAE,oBAAoB;QAC7C,0BAA0B,EAAE,uBAAuB;QACnD,kBAAkB,EAAE,gBAAgB;QACpC,oBAAoB,EAAE,kBAAkB;QACxC,qBAAqB,EAAE,mBAAmB;KAC3C,CAAC;IAEF,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,EAChB,MAAM,EACN,KAAK,EAAE,IAAS,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAA6B,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;iBACpG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;iBAC5E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACtD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;6BAC9D,CAAC,EAAE,CAAC;iBACN,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IAChD,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,UAAU,EAAE;KACtB,CAAC,CAAC;IAEH,qBAAqB;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,8BAA8B;IAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAEpD,gEAAgE;IAChE,MAAM,KAAK,GAAoB,CAAC,GAAG,aAAa,CAAC,CAAC;IAElD,2CAA2C;IAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEvF,qCAAqC;IACrC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEjC,sCAAsC;IACtC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;IAE5C,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,mBAAmB,WAAW,CAAC,QAAQ,CAAC,KAAK,kBAAkB,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAC;IACpH,OAAO,CAAC,KAAK,CAAC,gBAAgB,eAAe,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAEzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,KAAK,UAAU,QAAQ,CAAC,MAAkB;IACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAkB;IACvC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACxC,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Db,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,sBAAsB;IACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,cAAc;IACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,oBAAoB;IACpB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,cAAc,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAqB,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM;AACN,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,8BAA8B;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,SAAS,UAAU;IACjB,MAAM,MAAM,GAAe;QACzB,GAAG,cAAc;QAEjB,mCAAmC;QACnC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QAC/C,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW;QAC1C,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,cAAmC,IAAI,OAAO;QAEtE,UAAU;QACV,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,cAA0C,IAAI,MAAM;QAE5E,UAAU;QACV,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,YAA2C,IAAI,QAAQ;QAClF,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAE3C,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,OAAO;QACnD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QAEjC,gBAAgB;QAChB,aAAa,EAAE;YACb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe;gBAC5D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO;gBACnD,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACtC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC3C,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,KAAK,CAAC;gBAC9D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;gBAC1D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB;gBAC7D,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC1E,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,uBAA+B,IAAI,MAAM;aACrE,CAAC,CAAC,CAAC,SAAS;YAEb,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACxC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACjC,MAAM,EAAE,MAAe;oBACvB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;oBACpG,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,yBAA6E,IAAI,MAAM;iBACnH,CAAC,CAAC,CAAC,CAAC,SAAS;SACf;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,SAAS,wBAAwB,CAAC,MAAiB;IACjD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAE5D,4BAA4B;IAC5B,MAAM,SAAS,GAAwC;QACrD,0BAA0B,EAAE,uBAAuB;QACnD,yBAAyB,EAAE,sBAAsB;QACjD,mBAAmB,EAAE,iBAAiB;QACtC,uBAAuB,EAAE,oBAAoB;QAC7C,0BAA0B,EAAE,uBAAuB;QACnD,kBAAkB,EAAE,gBAAgB;QACpC,oBAAoB,EAAE,kBAAkB;QACxC,qBAAqB,EAAE,mBAAmB;KAC3C,CAAC;IAEF,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,EAChB,MAAM,EACN,KAAK,EAAE,IAAS,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAA6B,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;iBACpG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;iBAC5E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACtD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;6BAC9D,CAAC,EAAE,CAAC;iBACN,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IAChD,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,UAAU,EAAE;KACtB,CAAC,CAAC;IAEH,qBAAqB;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,8BAA8B;IAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAEpD,gEAAgE;IAChE,MAAM,KAAK,GAAoB,CAAC,GAAG,aAAa,CAAC,CAAC;IAElD,2CAA2C;IAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,mBAAmB,EAAE,CAAC;IACtB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEvF,qCAAqC;IACrC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEjC,sCAAsC;IACtC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;IAE5C,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,mBAAmB,WAAW,CAAC,QAAQ,CAAC,KAAK,kBAAkB,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAC;IACpH,OAAO,CAAC,KAAK,CAAC,gBAAgB,eAAe,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAEzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,KAAK,UAAU,QAAQ,CAAC,MAAkB;IACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAkB;IACvC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACxC,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Db,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,sBAAsB;IACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,cAAc;IACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,oBAAoB;IACpB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,cAAc,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAqB,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM;AACN,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC"}

package/dist/rugpull.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Mund - The Guardian Protocol
+ * MCP Rug-Pull Detection (OWASP ASI04)
+ *
+ * A rug pull is an MCP server that passes review at install time and
+ * then changes what its tools say or do. Static scanning can't see that,
+ * so Mund records a fingerprint of every tool when a server is first
+ * approved (the baseline) and diffs later manifests against it.
+ *
+ *   tool description changed  -> high   (the classic rug pull)
+ *   tool input schema changed -> medium
+ *   tool added                -> medium
+ *   tool removed              -> low
+ *   server name changed       -> high
+ *
+ * Any changed or added tool is re-scanned with the MCP analyzer; if it
+ * now trips a high/critical finding, or newly gains execution
+ * capability, the change is escalated to critical.
+ */
+import type { IAnalyzer, SecurityIssue, Severity } from './types.js';
+import { type McpServerManifest } from './analyzers/mcp-server-analyzer.js';
+export type ToolChangeKind = 'description_changed' | 'schema_changed' | 'tool_added' | 'tool_removed' | 'server_renamed';
+export interface ToolFingerprint {
+    descriptionHash: string;
+    schemaHash: string;
+    /** Kept so a diff can show what the description used to say. */
+    description: string;
+}
+export interface ManifestBaseline {
+    serverId: string;
+    serverName: string;
+    recordedAt: string;
+    tools: Record<string, ToolFingerprint>;
+}
+export interface ToolChange {
+    kind: ToolChangeKind;
+    tool: string;
+    severity: Severity;
+    detail: string;
+    /** Set when the changed tool now trips the MCP analyzer or gains execution capability. */
+    escalated?: string;
+}
+export interface RugPullResult {
+    serverId: string;
+    status: 'baseline_created' | 'unchanged' | 'changed';
+    changes: ToolChange[];
+    baselineRecordedAt?: string;
+}
+export declare function defaultBaselinePath(): string;
+export declare function fingerprintManifest(serverId: string, manifest: McpServerManifest): ManifestBaseline;
+/** Compare a manifest against its baseline. Pure: no I/O. */
+export declare function diffManifest(baseline: ManifestBaseline, manifest: McpServerManifest, analyzer?: IAnalyzer): Promise<ToolChange[]>;
+/** Persisted baselines, keyed by server id. */
+export declare class BaselineStore {
+    private path;
+    constructor(path?: string);
+    load(): Promise<Record<string, ManifestBaseline>>;
+    get(serverId: string): Promise<ManifestBaseline | undefined>;
+    /**
+     * Read-modify-write, serialized per file within the process (parallel
+     * audits of several servers used to overwrite each other's baselines),
+     * and written atomically via rename so a crash can't truncate the file.
+     */
+    put(baseline: ManifestBaseline): Promise<void>;
+    private static queues;
+}
+/**
+ * Check a manifest against its stored baseline. The first check for a
+ * server records the baseline. Pass acceptChanges to re-baseline after
+ * a human has reviewed the changes.
+ */
+export declare function checkRugPull(serverId: string, manifest: McpServerManifest, opts?: {
+    store?: BaselineStore;
+    analyzer?: IAnalyzer;
+    acceptChanges?: boolean;
+}): Promise<RugPullResult>;
+/** Express rug-pull changes as standard SecurityIssues (for scoring / SARIF). */
+export declare function changesToIssues(result: RugPullResult): SecurityIssue[];
+//# sourceMappingURL=rugpull.d.ts.map

package/dist/rugpull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rugpull.d.ts","sourceRoot":"","sources":["../src/rugpull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAqB,KAAK,iBAAiB,EAA0B,MAAM,oCAAoC,CAAC;AAEvH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,gBAAgB,CAAC;AAEzH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,kBAAkB,GAAG,WAAW,GAAG,SAAS,CAAC;IACrD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAcD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAUnG;AAED,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,GAAE,SAAmC,GAC5C,OAAO,CAAC,UAAU,EAAE,CAAC,CAgDvB;AAoBD,+CAA+C;AAC/C,qBAAa,aAAa;IACZ,OAAO,CAAC,IAAI;gBAAJ,IAAI,GAAE,MAA8B;IAElD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IASjD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAIlE;;;;OAIG;IACG,GAAG,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAcpD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAoC;CAC1D;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAClF,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,CAYtE"}