@weave_protocol/mund 0.3.1 → 0.4.0

package/DETECTION_CLAIMS.md

@@ -0,0 +1,48 @@
+# Mund detection claims
+
+Every claim below is backed by a fixture in this repository and a test that checks Mund returns the stated verdict. If a claim stops holding, CI fails.
+
+```bash
+cd mund && npm ci && npx vitest run tests/preinstall.test.ts tests/fixtures.test.ts
+```
+
+Verdicts: **block** (deny), **warn** (ask the user), **allow**. All fixture content is benign: the checks look at *how* something is built (hidden characters, package names, URLs), so no real attack payloads are needed to prove them.
+
+## Skills: checked before install
+
+| Claim: Mund catches… | Fixture | Verdict |
+|---|---|---|
+| Invisible Unicode tag characters (ASCII smuggling: text the model reads but a reviewer can't see) | [`skills/hidden-tag-characters`](tests/fixtures/preinstall/skills/hidden-tag-characters/SKILL.md) | **block** |
+| Bidirectional override characters that reorder what a reviewer sees | [`skills/bidi-override`](tests/fixtures/preinstall/skills/bidi-override/SKILL.md) | **block** |
+| A credential embedded in a skill | [`skills/embedded-secret`](tests/fixtures/preinstall/skills/embedded-secret/SKILL.md) | **block** |
+| Instructions to POST data to a collection service | [`skills/exfil-url`](tests/fixtures/preinstall/skills/exfil-url/SKILL.md) | **block** |
+| `curl … \| bash` installers | [`skills/curl-bash-installer`](tests/fixtures/preinstall/skills/curl-bash-installer/SKILL.md) | warn |
+| …and leaves a plain skill alone | [`skills/clean`](tests/fixtures/preinstall/skills/clean/SKILL.md) | allow |
+
+## MCP servers: how they're launched (static, nothing is started)
+
+| Claim: Mund catches… | Fixture | Verdict |
+|---|---|---|
+| A package scope imitating `@modelcontextprotocol` | [`scope-typosquat`](tests/fixtures/preinstall/mcp-config/scope-typosquat.json) | **block** |
+| A server URL pointing at a data-collection service | [`exfil-service-url`](tests/fixtures/preinstall/mcp-config/exfil-service-url.json) | **block** |
+| A package name within two edits of a known server (`githbu`) | [`name-typosquat`](tests/fixtures/preinstall/mcp-config/name-typosquat.json) | warn |
+| A remote server over plain HTTP | [`plain-http-remote`](tests/fixtures/preinstall/mcp-config/plain-http-remote.json) | warn |
+| A token written into the config instead of `${ENV_VAR}` | [`inline-token`](tests/fixtures/preinstall/mcp-config/inline-token.json) | warn |
+| A launcher that pipes a download into a shell | [`shell-pipeline-launcher`](tests/fixtures/preinstall/mcp-config/shell-pipeline-launcher.json) | warn |
+| An unpinned package (flagged, low severity) | [`unpinned-package`](tests/fixtures/preinstall/mcp-config/unpinned-package.json) | allow |
+| …and accepts `${ENV_VAR}` references and pinned official packages | [`env-reference`](tests/fixtures/preinstall/mcp-config/env-reference.json), [`clean-pinned`](tests/fixtures/preinstall/mcp-config/clean-pinned.json) | allow |
+
+## MCP servers: live checks and rug pulls
+
+Tested against a local fake MCP server ([`fake-mcp-server.mjs`](tests/fixtures/preinstall/fake-mcp-server.mjs)) in [`tests/preinstall.test.ts`](tests/preinstall.test.ts) and [`tests/fixtures/rugpull/`](tests/fixtures/rugpull):
+
+| Claim | Verdict |
+|---|---|
+| A tool description that changes after approval (a rug pull) is flagged until you accept it | warn |
+| A rug pull that adds a command-execution tool | **block** |
+| Mund never starts a project server you haven't approved; it checks it statically | — |
+| Mund never starts a server whose package or URL it already distrusts | — |
+
+## Limits
+
+Detection is pattern-based. These claims cover the attack shapes listed, not every variant: a paraphrased instruction with no hidden characters, URL or secret won't be caught by these checks. See the [OWASP coverage tables](README.md#️-owasp-coverage) for what is and isn't covered.

package/README.md

@@ -333,6 +333,27 @@ A rug pull is an MCP server that passes review at install time and then changes
 
 Re-check servers on startup or on a schedule. After a human reviews a change, pass `accept_changes: true` to update the baseline. Baselines are stored in `~/.config/mund/mcp-baselines.json` (override with `MUND_BASELINE_PATH`).
 
+## 🚪 Pre-Install Checks for Skills and MCP Servers
+
+Mund checks agent skills and MCP servers **before they get to act**. Every check is backed by a fixture; see [DETECTION_CLAIMS.md](DETECTION_CLAIMS.md).
+
+```bash
+npx @weave_protocol/mund agent-audit --live            # audit installed skills + configured MCP servers
+npx @weave_protocol/mund check-skill ./my-skill/       # check one skill before you install it
+```
+
+- **Skills:** hidden Unicode (invisible tag characters, bidi overrides), prompt injection, exfiltration instructions, dangerous commands, and embedded secrets, across `SKILL.md` and every file the skill ships.
+- **MCP servers, static:** package typosquats (including scopes imitating `@modelcontextprotocol`), unpinned packages, plain-HTTP or data-collection URLs, inline secrets, and shell-pipeline launchers.
+- **MCP servers, live (`--live`):** connects, lists the tools, scans their descriptions, and compares them with the rug-pull baseline.
+
+Verdicts are **block**, **warn** or **allow**. Configs are read from Claude Code (`.mcp.json`, `~/.claude.json`, Claude Desktop) or, with `--harness=antigravity`, from Antigravity (`.agents/`, `~/.gemini/config/`).
+
+**Safety:** the live check never starts a project or workspace server you haven't approved, or a server whose package or URL it already distrusts. Those get static checks only.
+
+**Enforcement** comes from the harness adapters, which run these checks as hooks:
+- [`@weave_protocol/adapter-claudecode`](../adapter-claudecode#mund-pre-install-hooks): `weave-claude-code mund install`
+- [`@weave_protocol/adapter-antigravity`](../adapter-antigravity#mund-pre-install-hooks): `weave-antigravity mund install`
+
 ## 🐤 Canary Tokens (System Prompt Leakage)
 
 Put a canary in your system prompt. If a model is ever talked into revealing its instructions, the canary comes out with them, and Mund flags it in any scanned output. That includes copies with changed case, spacing or zero-width characters inserted, base64 encoding, or reversal.

package/dist/agent-audit.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Mund - The Guardian Protocol
+ * Agent audit: pre-install checks for skills and MCP servers
+ *
+ * Backs the "pre-install" hooks in the Weave Protocol harness adapters:
+ *
+ *   - Skills: scan SKILL.md and every text file in a skill directory for
+ *     prompt injection, exfiltration, dangerous code, secrets and hidden
+ *     Unicode (invisible "tag" characters can smuggle instructions that a
+ *     human reviewer never sees).
+ *   - MCP servers: static checks on how each configured server is launched
+ *     (package typosquats, unpinned packages, insecure or exfil URLs, inline
+ *     secrets), plus an optional live check that connects, lists the tools,
+ *     scans their descriptions, and compares them with the rug-pull baseline.
+ *
+ * SAFETY: the live check starts server processes. It only does that for
+ * servers the user configured themselves (user/local scope) or explicitly
+ * approved for this project. Project `.mcp.json` servers that Claude Code
+ * would still ask about are checked statically only, so opening a
+ * malicious repository never runs its servers through Mund.
+ */
+import type { SecurityIssue } from './types.js';
+import { type McpServerManifest } from './analyzers/mcp-server-analyzer.js';
+import { type RiskScore } from './scoring.js';
+import { BaselineStore, type RugPullResult } from './rugpull.js';
+export type Verdict = 'allow' | 'warn' | 'block';
+/** Which agent harness's config layout to audit. */
+export type Harness = 'claude' | 'antigravity';
+export interface SkillAudit {
+    name: string;
+    path: string;
+    scope: 'project' | 'user' | 'workspace' | 'global' | 'plugin';
+    verdict: Verdict;
+    risk: RiskScore;
+    issues: SecurityIssue[];
+}
+export interface McpServerConfig {
+    type?: string;
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    url?: string;
+    /** Antigravity spelling of url */
+    serverUrl?: string;
+    headers?: Record<string, string>;
+    disabled?: boolean;
+}
+export interface McpServerAudit {
+    name: string;
+    scope: 'project' | 'local' | 'user' | 'desktop' | 'workspace' | 'global';
+    transport: 'stdio' | 'http' | 'sse' | 'unknown';
+    target: string;
+    verdict: Verdict;
+    risk: RiskScore;
+    issues: SecurityIssue[];
+    live: {
+        status: 'ok' | 'error' | 'skipped';
+        reason?: string;
+        tools?: number;
+        rugpull?: RugPullResult['status'];
+    };
+}
+export interface AgentAuditReport {
+    version: 1;
+    tool: {
+        name: 'mund';
+        version: string;
+    };
+    generatedAt: string;
+    cwd: string;
+    servers: McpServerAudit[];
+    skills: SkillAudit[];
+    summary: Record<Verdict, number>;
+}
+/**
+ * critical → block; high in a blocking category (injection, exfiltration,
+ * hidden Unicode) → block; other high/medium → warn; else allow.
+ */
+export declare function verdictFor(issues: Array<Pick<SecurityIssue, 'severity' | 'type'>>): Verdict;
+/** Scan one piece of skill content (a SKILL.md or a file shipped with the skill). */
+export declare function scanSkillContent(content: string): Promise<SecurityIssue[]>;
+export declare function scanSkillDir(dir: string, scope?: SkillAudit['scope']): Promise<SkillAudit>;
+export declare function skillRoots(cwd: string, home?: string, harness?: Harness): Array<[string, SkillAudit['scope']]>;
+export declare function discoverSkillDirs(cwd: string, home?: string, harness?: Harness): Array<{
+    dir: string;
+    scope: SkillAudit['scope'];
+}>;
+interface DiscoveredServer {
+    name: string;
+    scope: McpServerAudit['scope'];
+    config: McpServerConfig;
+    /** Started by the user's own configuration or explicitly approved; safe to start for a live check. */
+    approved: boolean;
+}
+/** Claude Desktop's config, which also supplies MCP servers to its Code tab. */
+export declare function claudeDesktopConfigPath(home?: string): string;
+/**
+ * Claude Code MCP config: <cwd>/.mcp.json (project), ~/.claude.json (user +
+ * per-project local), and Claude Desktop's claude_desktop_config.json.
+ */
+export declare function discoverMcpServers(cwd: string, home?: string): DiscoveredServer[];
+/**
+ * Antigravity MCP config: <workspace>/.agents/mcp_config.json and
+ * ~/.gemini/config/mcp_config.json. Workspace servers are checked
+ * statically only (same consent rule as Claude Code project servers);
+ * servers marked "disabled" are never started.
+ */
+export declare function discoverAntigravityMcpServers(cwd: string, home?: string): DiscoveredServer[];
+/** The package a launcher like `npx -y pkg@1.2.3` runs, if any. */
+export declare function launchedPackage(config: McpServerConfig): {
+    name: string;
+    version?: string;
+} | null;
+/** Static checks on how a server is launched. No processes are started. */
+export declare function checkMcpServerConfig(name: string, config: McpServerConfig): Promise<SecurityIssue[]>;
+/** Connect to a server, list its tools, and return them as a manifest. */
+export declare function fetchLiveManifest(name: string, config: McpServerConfig, timeoutMs?: number): Promise<McpServerManifest>;
+export declare function calibrateLiveFindings(issues: SecurityIssue[]): SecurityIssue[];
+export declare function auditMcpServer(server: DiscoveredServer, opts?: {
+    live?: boolean;
+    store?: BaselineStore;
+    timeoutMs?: number;
+    accept?: string[];
+    harness?: Harness;
+}): Promise<McpServerAudit>;
+/** Cache key: sha256(resolved cwd), plus the harness for non-Claude layouts. */
+export declare function auditCachePath(cwd: string, harness?: Harness): string;
+export declare function runAgentAudit(opts?: {
+    cwd?: string;
+    live?: boolean;
+    home?: string;
+    store?: BaselineStore;
+    timeoutMs?: number;
+    writeCache?: boolean;
+    accept?: string[];
+    harness?: Harness;
+}): Promise<AgentAuditReport>;
+export {};
+//# sourceMappingURL=agent-audit.d.ts.map

package/dist/agent-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-audit.d.ts","sourceRoot":"","sources":["../src/agent-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,YAAY,CAAC;AAI1D,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,aAAa,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhG,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,oDAAoD;AACpD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE/C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACzE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,IAAI,EAAE;QAAE,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CAClH;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAClC;AAQD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,OAAO,CAO3F;AAmCD,qFAAqF;AACrF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEhF;AAaD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,UAAU,CAAC,OAAO,CAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAU3G;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,EAAE,OAAO,GAAE,OAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAgB3H;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,EAAE,OAAO,GAAE,OAAkB,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAUhJ;AAMD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,eAAe,CAAC;IACxB,sGAAsG;IACtG,QAAQ,EAAE,OAAO,CAAC;CACnB;AAUD,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,IAAI,SAAY,GAAG,MAAM,CAIhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,gBAAgB,EAAE,CA4BpF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,gBAAgB,EAAE,CAW/F;AAmBD,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUlG;AAMD,2EAA2E;AAC3E,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CA2D1G;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoC3H;AAaD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAI9E;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7G,OAAO,CAAC,cAAc,CAAC,CAwCzB;AAMD,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,OAAkB,GAAG,MAAM,CAI/E;AAED,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiBhO"}

package/dist/agent-audit.js

@@ -0,0 +1,424 @@
+/**
+ * Mund - The Guardian Protocol
+ * Agent audit: pre-install checks for skills and MCP servers
+ *
+ * Backs the "pre-install" hooks in the Weave Protocol harness adapters:
+ *
+ *   - Skills: scan SKILL.md and every text file in a skill directory for
+ *     prompt injection, exfiltration, dangerous code, secrets and hidden
+ *     Unicode (invisible "tag" characters can smuggle instructions that a
+ *     human reviewer never sees).
+ *   - MCP servers: static checks on how each configured server is launched
+ *     (package typosquats, unpinned packages, insecure or exfil URLs, inline
+ *     secrets), plus an optional live check that connects, lists the tools,
+ *     scans their descriptions, and compares them with the rug-pull baseline.
+ *
+ * SAFETY: the live check starts server processes. It only does that for
+ * servers the user configured themselves (user/local scope) or explicitly
+ * approved for this project. Project `.mcp.json` servers that Claude Code
+ * would still ask about are checked statically only, so opening a
+ * malicious repository never runs its servers through Mund.
+ */
+import { createHash } from 'crypto';
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { mkdir, writeFile } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join, resolve } from 'path';
+import { DEFAULT_RULES, DANGEROUS_URL_PATTERNS } from './constants.js';
+import { AnalyzerEngine } from './analyzers/index.js';
+import { SecretScanner } from './analyzers/secret-scanner.js';
+import { McpServerAnalyzer } from './analyzers/mcp-server-analyzer.js';
+import { computeRiskScore } from './scoring.js';
+import { checkRugPull, changesToIssues } from './rugpull.js';
+import { getVersion } from './version.js';
+// mcp_rugpull is deliberately absent: a plain change (reworded description,
+// new optional parameter) warns until accepted; only escalated changes
+// (now malicious-looking or newly executing commands) are critical → block.
+const BLOCK_TYPES = new Set(['injection', 'exfiltration', 'hidden_unicode']);
+const MAX_FILE = 512 * 1024;
+/**
+ * critical → block; high in a blocking category (injection, exfiltration,
+ * hidden Unicode) → block; other high/medium → warn; else allow.
+ */
+export function verdictFor(issues) {
+    let verdict = 'allow';
+    for (const i of issues) {
+        if (i.severity === 'critical' || (i.severity === 'high' && BLOCK_TYPES.has(i.type)))
+            return 'block';
+        if (i.severity === 'high' || i.severity === 'medium')
+            verdict = 'warn';
+    }
+    return verdict;
+}
+// ============================================================================
+// Skills
+// ============================================================================
+const engine = new AnalyzerEngine();
+/** Invisible characters used to hide instructions from human reviewers. */
+const HIDDEN_CHARS = [
+    { re: /[\u{E0000}-\u{E007F}]/u, name: 'Unicode tag characters (invisible ASCII smuggling)', severity: 'critical' },
+    { re: /[‪-‮⁦-⁩]/, name: 'bidirectional override characters', severity: 'high' },
+    { re: /[​-‍⁠]{3,}/, name: 'runs of zero-width characters', severity: 'high' },
+];
+function hiddenUnicode(content) {
+    const issues = [];
+    for (const h of HIDDEN_CHARS) {
+        const m = h.re.exec(content);
+        if (!m)
+            continue;
+        const before = content.slice(0, m.index).split('\n');
+        issues.push({
+            rule_id: 'hidden_unicode',
+            rule_name: `Hidden text: ${h.name}`,
+            type: 'hidden_unicode',
+            severity: h.severity,
+            action: 'block',
+            match: `U+${m[0].codePointAt(0).toString(16).toUpperCase()}`,
+            location: { start: m.index, end: m.index + m[0].length, line: before.length, column: before[before.length - 1].length + 1 },
+            suggestion: 'Text that is invisible to reviewers but readable by the model. Remove it or reject this skill.',
+        });
+    }
+    return issues;
+}
+/** Scan one piece of skill content (a SKILL.md or a file shipped with the skill). */
+export async function scanSkillContent(content) {
+    return [...hiddenUnicode(content), ...(await engine.analyzeAll(content, DEFAULT_RULES))];
+}
+function textFiles(dir, out = [], depth = 0) {
+    if (depth > 4)
+        return out;
+    for (const e of readdirSync(dir, { withFileTypes: true })) {
+        if (e.name === 'node_modules' || e.name === '.git')
+            continue;
+        const p = join(dir, e.name);
+        if (e.isDirectory())
+            textFiles(p, out, depth + 1);
+        else if (e.isFile() && statSync(p).size <= MAX_FILE)
+            out.push(p);
+    }
+    return out;
+}
+export async function scanSkillDir(dir, scope = 'project') {
+    const issues = [];
+    for (const file of textFiles(dir)) {
+        const buf = readFileSync(file);
+        if (buf.subarray(0, 4096).includes(0))
+            continue; // binary
+        for (const issue of await scanSkillContent(buf.toString('utf8'))) {
+            issues.push({ ...issue, rule_name: `${issue.rule_name} (${file.slice(dir.length + 1)})` });
+        }
+    }
+    return { name: dir.split(/[\\/]/).pop(), path: dir, scope, verdict: verdictFor(issues), risk: computeRiskScore(issues), issues };
+}
+export function skillRoots(cwd, home = homedir(), harness = 'claude') {
+    if (harness === 'antigravity') {
+        const roots = [
+            [join(cwd, '.agents', 'skills'), 'workspace'],
+            [join(cwd, '.agent', 'skills'), 'workspace'],
+            [join(home, '.gemini', 'config', 'skills'), 'global'],
+            [join(home, '.gemini', 'antigravity-cli', 'skills'), 'global'],
+            [join(home, '.gemini', 'antigravity', 'skills'), 'global'],
+        ];
+        const plugins = join(home, '.gemini', 'antigravity-cli', 'plugins');
+        if (existsSync(plugins)) {
+            for (const p of readdirSync(plugins, { withFileTypes: true }))
+                if (p.isDirectory())
+                    roots.push([join(plugins, p.name, 'skills'), 'plugin']);
+        }
+        return roots;
+    }
+    return [[join(cwd, '.claude', 'skills'), 'project'], [join(home, '.claude', 'skills'), 'user']];
+}
+export function discoverSkillDirs(cwd, home = homedir(), harness = 'claude') {
+    const roots = skillRoots(cwd, home, harness);
+    const out = [];
+    for (const [root, scope] of roots) {
+        if (!existsSync(root))
+            continue;
+        for (const e of readdirSync(root, { withFileTypes: true })) {
+            if (e.isDirectory() && existsSync(join(root, e.name, 'SKILL.md')))
+                out.push({ dir: join(root, e.name), scope });
+        }
+    }
+    return out;
+}
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Claude Desktop's config, which also supplies MCP servers to its Code tab. */
+export function claudeDesktopConfigPath(home = homedir()) {
+    if (process.platform === 'win32')
+        return join(process.env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json');
+    if (process.platform === 'darwin')
+        return join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+    return join(home, '.config', 'Claude', 'claude_desktop_config.json');
+}
+/**
+ * Claude Code MCP config: <cwd>/.mcp.json (project), ~/.claude.json (user +
+ * per-project local), and Claude Desktop's claude_desktop_config.json.
+ */
+export function discoverMcpServers(cwd, home = homedir()) {
+    const out = [];
+    const claudeJson = readJson(join(home, '.claude.json')) ?? {};
+    const projectEntry = claudeJson.projects?.[cwd] ?? {};
+    const settings = [join(cwd, '.claude', 'settings.json'), join(cwd, '.claude', 'settings.local.json'), join(home, '.claude', 'settings.json')]
+        .map(readJson)
+        .filter(Boolean);
+    const enableAll = settings.some((s) => s.enableAllProjectMcpServers === true) || projectEntry.enableAllProjectMcpServers === true;
+    const enabled = new Set([
+        ...(projectEntry.enabledMcpjsonServers ?? []),
+        ...settings.flatMap((s) => s.enabledMcpjsonServers ?? []),
+    ]);
+    const disabled = new Set([...(projectEntry.disabledMcpjsonServers ?? []), ...settings.flatMap((s) => s.disabledMcpjsonServers ?? [])]);
+    for (const [name, config] of Object.entries(readJson(join(cwd, '.mcp.json'))?.mcpServers ?? {})) {
+        out.push({ name, scope: 'project', config, approved: !disabled.has(name) && (enableAll || enabled.has(name)) });
+    }
+    for (const [name, config] of Object.entries(projectEntry.mcpServers ?? {})) {
+        out.push({ name, scope: 'local', config, approved: true });
+    }
+    for (const [name, config] of Object.entries(claudeJson.mcpServers ?? {})) {
+        out.push({ name, scope: 'user', config, approved: true });
+    }
+    const seen = new Set(out.map((s) => s.name));
+    for (const [name, config] of Object.entries(readJson(claudeDesktopConfigPath(home))?.mcpServers ?? {})) {
+        if (!seen.has(name))
+            out.push({ name, scope: 'desktop', config, approved: true });
+    }
+    return out;
+}
+/**
+ * Antigravity MCP config: <workspace>/.agents/mcp_config.json and
+ * ~/.gemini/config/mcp_config.json. Workspace servers are checked
+ * statically only (same consent rule as Claude Code project servers);
+ * servers marked "disabled" are never started.
+ */
+export function discoverAntigravityMcpServers(cwd, home = homedir()) {
+    const out = [];
+    const add = (path, scope, approved) => {
+        for (const [name, raw] of Object.entries(readJson(path)?.mcpServers ?? {})) {
+            const config = { ...raw, url: raw.url ?? raw.serverUrl };
+            out.push({ name, scope, config, approved: approved && !raw.disabled });
+        }
+    };
+    add(join(cwd, '.agents', 'mcp_config.json'), 'workspace', false);
+    add(join(home, '.gemini', 'config', 'mcp_config.json'), 'global', true);
+    return out;
+}
+/** Expand ${VAR} and ${VAR:-default} the way Claude Code does in .mcp.json. */
+function expand(value, env = process.env) {
+    return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (_, k, d) => env[k] ?? d ?? '');
+}
+const PACKAGE_RUNNERS = new Set(['npx', 'bunx', 'uvx', 'pipx', 'pnpx']);
+const OFFICIAL_SCOPE = 'modelcontextprotocol';
+function lev(a, b) {
+    const d = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+    for (let j = 1; j <= b.length; j++)
+        d[0][j] = j;
+    for (let i = 1; i <= a.length; i++)
+        for (let j = 1; j <= b.length; j++)
+            d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    return d[a.length][b.length];
+}
+/** The package a launcher like `npx -y pkg@1.2.3` runs, if any. */
+export function launchedPackage(config) {
+    const cmd = (config.command ?? '').split(/[\\/]/).pop() ?? '';
+    let args = config.args ?? [];
+    if (cmd === 'pnpm' || cmd === 'yarn')
+        args = args[0] === 'dlx' ? args.slice(1) : [];
+    else if (cmd === 'pipx')
+        args = args[0] === 'run' ? args.slice(1) : [];
+    else if (!PACKAGE_RUNNERS.has(cmd))
+        return null;
+    const spec = args.find((a) => !a.startsWith('-'));
+    if (!spec)
+        return null;
+    const at = spec.lastIndexOf('@');
+    return at > 0 ? { name: spec.slice(0, at), version: spec.slice(at + 1) } : { name: spec };
+}
+const finding = (rule_id, rule_name, severity, type, match, suggestion) => ({
+    rule_id, rule_name, severity, type, action: severity === 'critical' ? 'block' : 'alert', match, suggestion,
+});
+/** Static checks on how a server is launched. No processes are started. */
+export async function checkMcpServerConfig(name, config) {
+    const issues = [];
+    // Inline secrets in args, env, headers or URL
+    const secrets = await new SecretScanner().analyze([...(config.args ?? []), ...Object.values(config.env ?? {}), ...Object.values(config.headers ?? {}), config.url ?? ''].filter((v) => !/^\$\{[^}]+\}$/.test(v)).join('\n'), DEFAULT_RULES);
+    for (const s of secrets) {
+        issues.push(finding('mcp_config_inline_secret', `Secret written into MCP config: ${s.rule_name}`, 'high', 'secret', s.match, 'Reference it as ${ENV_VAR} instead; config files get committed and shared.'));
+    }
+    // Package typosquats and unpinned packages
+    const pkg = launchedPackage(config);
+    if (pkg) {
+        const scope = pkg.name.startsWith('@') ? pkg.name.slice(1).split('/')[0] : null;
+        if (scope && scope !== OFFICIAL_SCOPE && lev(scope, OFFICIAL_SCOPE) <= 3) {
+            issues.push(finding('mcp_package_scope_typosquat', `Package scope "@${scope}" imitates the official "@${OFFICIAL_SCOPE}"`, 'critical', 'supply_chain', pkg.name, 'Do not run this server. Check the package name character by character.'));
+        }
+        const short = pkg.name.split('/').pop().replace(/^(mcp-server-|server-|mcp-)|(-mcp-server|-mcp|-server)$/g, '');
+        for (const t of new McpServerAnalyzer().checkTyposquatting({ name: short, version: '0' })) {
+            issues.push({ ...t, type: 'supply_chain', rule_name: `${t.rule_name} (package ${pkg.name})` });
+        }
+        if (!pkg.version || pkg.version === 'latest') {
+            issues.push(finding('mcp_unpinned_package', `Package ${pkg.name} is not pinned to a version`, 'low', 'supply_chain', pkg.name, `Pin it (e.g. ${pkg.name}@1.2.3) so an upstream update can't change the server under you.`));
+        }
+    }
+    // Remote URL checks
+    if (config.url) {
+        const url = expand(config.url);
+        for (const p of DANGEROUS_URL_PATTERNS) {
+            if (p.test(url))
+                issues.push(finding('mcp_dangerous_url', 'MCP server URL points at a data-collection service', 'critical', 'exfiltration', url, 'Remove this server.'));
+        }
+        try {
+            const u = new URL(url);
+            const local = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(u.hostname);
+            if (u.protocol === 'http:' && !local) {
+                issues.push(finding('mcp_insecure_transport', 'Remote MCP server over plain HTTP', 'medium', 'transport', url, 'Use https:// so tool traffic and tokens are encrypted.'));
+            }
+            if (/^\d{1,3}(\.\d{1,3}){3}$/.test(u.hostname) && !local) {
+                issues.push(finding('mcp_ip_url', 'Remote MCP server addressed by raw IP', 'medium', 'transport', url, 'Prefer a named, TLS-verified host.'));
+            }
+        }
+        catch {
+            issues.push(finding('mcp_bad_url', 'MCP server URL does not parse', 'medium', 'transport', url, 'Fix the URL.'));
+        }
+    }
+    // Dangerous launch commands (e.g. sh -c "curl … | bash")
+    const launch = [config.command ?? '', ...(config.args ?? [])].join(' ');
+    for (const i of await engine.analyzeAll(launch, DEFAULT_RULES.filter((r) => r.type === 'code_pattern'))) {
+        issues.push({ ...i, rule_name: `Launch command: ${i.rule_name}` });
+    }
+    void name;
+    return issues;
+}
+/** Connect to a server, list its tools, and return them as a manifest. */
+export async function fetchLiveManifest(name, config, timeoutMs = 8000) {
+    const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
+    const client = new Client({ name: 'mund-agent-audit', version: getVersion() });
+    let transport;
+    if (config.url) {
+        if (config.type === 'sse')
+            throw new Error('SSE transport not checked live (deprecated); static checks only');
+        const { StreamableHTTPClientTransport } = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
+        const headers = Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v)]));
+        transport = new StreamableHTTPClientTransport(new URL(expand(config.url)), { requestInit: { headers } });
+    }
+    else if (config.command) {
+        const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
+        transport = new StdioClientTransport({
+            command: expand(config.command),
+            args: (config.args ?? []).map((a) => expand(a)),
+            env: { ...process.env, ...Object.fromEntries(Object.entries(config.env ?? {}).map(([k, v]) => [k, expand(v)])) },
+            stderr: 'ignore',
+        });
+    }
+    else {
+        throw new Error('no command or url');
+    }
+    const timeout = new Promise((_, rej) => setTimeout(() => rej(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs).unref());
+    try {
+        await Promise.race([client.connect(transport), timeout]);
+        const tools = [];
+        let cursor;
+        do {
+            const page = await Promise.race([client.listTools(cursor ? { cursor } : undefined), timeout]);
+            for (const t of page.tools)
+                tools.push({ name: t.name, description: t.description, inputSchema: t.inputSchema });
+            cursor = page.nextCursor;
+        } while (cursor && tools.length < 2000);
+        const info = client.getServerVersion();
+        return { name: info?.name ?? name, version: info?.version ?? '0', tools };
+    }
+    finally {
+        await client.close().catch(() => { });
+    }
+}
+/**
+ * Live manifest findings, calibrated for a pre-install verdict:
+ *  - typosquat rules are dropped: a server's self-reported name proves
+ *    nothing, and the launch package is already checked statically;
+ *  - capability findings ("can run commands", "touches files", many tools)
+ *    describe what a server does, not that it's malicious, so they're kept
+ *    as info. A server that newly GAINS execution is still escalated by
+ *    rug-pull detection.
+ */
+const DROP_LIVE = new Set(['mcp_typosquatting', 'mcp_typosquatting_pattern', 'mcp_missing_version']);
+const DESCRIPTIVE_LIVE = /^mcp_capability_|^mcp_execution_warning$|^mcp_excessive_tools$/;
+export function calibrateLiveFindings(issues) {
+    return issues
+        .filter((i) => !DROP_LIVE.has(i.rule_id))
+        .map((i) => (DESCRIPTIVE_LIVE.test(i.rule_id) ? { ...i, severity: 'info', action: 'log' } : i));
+}
+export async function auditMcpServer(server, opts = {}) {
+    const { name, scope, config } = server;
+    const issues = await checkMcpServerConfig(name, config);
+    const transport = config.url ? (config.type === 'sse' ? 'sse' : 'http') : config.command ? 'stdio' : 'unknown';
+    let live = { status: 'skipped', reason: 'live checks disabled' };
+    // Never launch a server the static checks already distrust: a typosquat
+    // package or an exfil URL must not be started "to have a look".
+    const distrusted = verdictFor(issues) === 'block' ||
+        issues.some((i) => (i.severity === 'critical' || i.severity === 'high') && (i.type === 'supply_chain' || i.type === 'exfiltration'));
+    if (opts.live) {
+        if (!server.approved) {
+            live = { status: 'skipped', reason: server.config.disabled ? 'server is disabled in config' : 'workspace/project server not approved for automatic start; static checks only' };
+        }
+        else if (distrusted) {
+            live = { status: 'skipped', reason: 'not started: static checks already flag its package or URL' };
+        }
+        else {
+            try {
+                const manifest = await fetchLiveManifest(name, config, opts.timeoutMs);
+                issues.push(...calibrateLiveFindings(await new McpServerAnalyzer().analyze(JSON.stringify(manifest), [])));
+                const accept = !!opts.accept?.some((a) => a === 'all' || a === name);
+                const rug = await checkRugPull(`${opts.harness ?? 'claude'}:${scope}:${name}`, manifest, { store: opts.store, acceptChanges: accept });
+                issues.push(...changesToIssues(rug));
+                live = { status: 'ok', tools: manifest.tools?.length ?? 0, rugpull: rug.status };
+            }
+            catch (err) {
+                live = { status: 'error', reason: err.message };
+            }
+        }
+    }
+    return {
+        name,
+        scope,
+        transport,
+        target: config.url ?? [config.command, ...(config.args ?? [])].filter(Boolean).join(' '),
+        verdict: verdictFor(issues),
+        risk: computeRiskScore(issues),
+        issues,
+        live,
+    };
+}
+// ============================================================================
+// Full audit + cache
+// ============================================================================
+/** Cache key: sha256(resolved cwd), plus the harness for non-Claude layouts. */
+export function auditCachePath(cwd, harness = 'claude') {
+    const base = process.env.MUND_AUDIT_CACHE_DIR || join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'mund', 'agent-audit');
+    const key = createHash('sha256').update(resolve(cwd)).digest('hex').slice(0, 16);
+    return join(base, harness === 'claude' ? `${key}.json` : `${key}.${harness}.json`);
+}
+export async function runAgentAudit(opts = {}) {
+    const cwd = resolve(opts.cwd ?? process.cwd());
+    const home = opts.home ?? homedir();
+    const [servers, skills] = await Promise.all([
+        Promise.all((opts.harness === 'antigravity' ? discoverAntigravityMcpServers(cwd, home) : discoverMcpServers(cwd, home)).map((s) => auditMcpServer(s, opts))),
+        Promise.all(discoverSkillDirs(cwd, home, opts.harness).map(({ dir, scope }) => scanSkillDir(dir, scope))),
+    ]);
+    const summary = { allow: 0, warn: 0, block: 0 };
+    for (const x of [...servers, ...skills])
+        summary[x.verdict]++;
+    const report = { version: 1, tool: { name: 'mund', version: getVersion() }, generatedAt: new Date().toISOString(), cwd, servers, skills, summary };
+    if (opts.writeCache !== false) {
+        const path = auditCachePath(cwd, opts.harness);
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, JSON.stringify(report, null, 2));
+    }
+    return report;
+}
+//# sourceMappingURL=agent-audit.js.map