@weave_protocol/mund 0.4.1 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +9 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +21 -318
- package/dist/index.js.map +1 -1
- package/dist/scan.d.ts +27 -0
- package/dist/scan.d.ts.map +1 -0
- package/dist/scan.js +25 -0
- package/dist/scan.js.map +1 -0
- package/dist/server.d.ts +7 -0
- package/dist/server.d.ts.map +1 -0
- package/dist/server.js +321 -0
- package/dist/server.js.map +1 -0
- package/package.json +3 -3
- package/src/index.ts +28 -388
- package/src/scan.ts +42 -0
- package/src/server.ts +390 -0
package/dist/index.d.ts
CHANGED
|
@@ -1,9 +1,15 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
1
|
/**
|
|
3
|
-
*
|
|
4
|
-
*
|
|
2
|
+
* @weave_protocol/mund: library entry point.
|
|
3
|
+
* The MCP server lives in server.ts (bin).
|
|
5
4
|
*/
|
|
6
5
|
export { ThreatIntelManager, threatIntel } from './threat-intel-manager.js';
|
|
7
6
|
export { threatIntelTools, createThreatIntelToolHandlers } from './threat-intel-tools.js';
|
|
8
7
|
export * from './threat-intel-types.js';
|
|
8
|
+
export { scan, SCAN_TYPES } from './scan.js';
|
|
9
|
+
export type { ScanType, ScanOptions, ScanResult } from './scan.js';
|
|
10
|
+
export { AnalyzerEngine, getAnalyzers, SecretScanner, PIIDetector, CodeAnalyzer, InjectionDetector, ExfiltrationDetector, McpServerAnalyzer, } from './analyzers/index.js';
|
|
11
|
+
export { DEFAULT_RULES } from './constants.js';
|
|
12
|
+
export { computeRiskScore, labelForScore } from './scoring.js';
|
|
13
|
+
export type { RiskScore } from './scoring.js';
|
|
14
|
+
export type { Severity, SecurityIssue, DetectionRule, IAnalyzer } from './types.js';
|
|
9
15
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EACL,cAAc,EAAE,YAAY,EAC5B,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,GACrG,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,324 +1,27 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
1
|
/**
|
|
3
|
-
*
|
|
4
|
-
*
|
|
2
|
+
* @weave_protocol/mund: library entry point.
|
|
3
|
+
* The MCP server lives in server.ts (bin).
|
|
5
4
|
*/
|
|
6
|
-
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
|
|
7
|
-
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
|
|
8
|
-
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
|
|
9
|
-
import express from 'express';
|
|
10
|
-
import { DEFAULT_CONFIG, DEFAULT_RULES } from './constants.js';
|
|
11
|
-
import { createStorage } from './storage/index.js';
|
|
12
|
-
import { AnalyzerEngine } from './analyzers/index.js';
|
|
13
|
-
import { NotificationHub } from './notifications/index.js';
|
|
14
|
-
import { registerAllTools } from './tools/index.js';
|
|
15
|
-
import { runScanCli } from './cli/scan.js';
|
|
16
|
-
import { runAgentAuditCli, runCheckSkillCli } from './cli/agent.js';
|
|
17
|
-
import { getVersion } from './version.js';
|
|
18
|
-
import { loadCanariesFromEnv } from './canary.js';
|
|
19
|
-
// Threat Intelligence imports
|
|
20
|
-
import { threatIntel } from './threat-intel-manager.js';
|
|
21
|
-
import { threatIntelTools, createThreatIntelToolHandlers, UpdateThreatIntelSchema, ListIntelSourcesSchema, IntelStatusSchema, AddIntelSourceSchema, RemoveIntelSourceSchema, ThreatScanSchema, ListPatternsSchema, TogglePatternSchema, } from './threat-intel-tools.js';
|
|
22
|
-
// ============================================================================
|
|
23
|
-
// Configuration Loading
|
|
24
|
-
// ============================================================================
|
|
25
|
-
function loadConfig() {
|
|
26
|
-
const config = {
|
|
27
|
-
...DEFAULT_CONFIG,
|
|
28
|
-
// Server settings from environment
|
|
29
|
-
port: parseInt(process.env.MUND_PORT || '3000'),
|
|
30
|
-
host: process.env.MUND_HOST || '127.0.0.1',
|
|
31
|
-
transport: process.env.MUND_TRANSPORT || 'stdio',
|
|
32
|
-
// Logging
|
|
33
|
-
log_level: process.env.MUND_LOG_LEVEL || 'info',
|
|
34
|
-
// Storage
|
|
35
|
-
storage_type: process.env.MUND_STORAGE || 'memory',
|
|
36
|
-
database_url: process.env.MUND_DATABASE_URL,
|
|
37
|
-
// Security
|
|
38
|
-
block_mode: process.env.MUND_BLOCK_MODE === 'block',
|
|
39
|
-
api_key: process.env.MUND_API_KEY,
|
|
40
|
-
// Notifications
|
|
41
|
-
notifications: {
|
|
42
|
-
slack: process.env.MUND_SLACK_WEBHOOK ? {
|
|
43
|
-
webhook_url: process.env.MUND_SLACK_WEBHOOK,
|
|
44
|
-
channel: process.env.MUND_SLACK_CHANNEL,
|
|
45
|
-
username: process.env.MUND_SLACK_USERNAME || 'Mund Guardian',
|
|
46
|
-
icon_emoji: process.env.MUND_SLACK_EMOJI || ':eye:',
|
|
47
|
-
min_severity: process.env.MUND_SLACK_MIN_SEVERITY || 'high'
|
|
48
|
-
} : undefined,
|
|
49
|
-
teams: process.env.MUND_TEAMS_WEBHOOK ? {
|
|
50
|
-
webhook_url: process.env.MUND_TEAMS_WEBHOOK,
|
|
51
|
-
min_severity: process.env.MUND_TEAMS_MIN_SEVERITY || 'high'
|
|
52
|
-
} : undefined,
|
|
53
|
-
email: process.env.MUND_EMAIL_SMTP_HOST ? {
|
|
54
|
-
smtp_host: process.env.MUND_EMAIL_SMTP_HOST,
|
|
55
|
-
smtp_port: parseInt(process.env.MUND_EMAIL_SMTP_PORT || '587'),
|
|
56
|
-
smtp_secure: process.env.MUND_EMAIL_SMTP_SECURE === 'true',
|
|
57
|
-
smtp_user: process.env.MUND_EMAIL_SMTP_USER,
|
|
58
|
-
smtp_pass: process.env.MUND_EMAIL_SMTP_PASS,
|
|
59
|
-
from_address: process.env.MUND_EMAIL_FROM || 'mund@localhost',
|
|
60
|
-
to_addresses: (process.env.MUND_EMAIL_TO || '').split(',').filter(Boolean),
|
|
61
|
-
min_severity: process.env.MUND_EMAIL_MIN_SEVERITY || 'high'
|
|
62
|
-
} : undefined,
|
|
63
|
-
webhooks: process.env.MUND_WEBHOOK_URL ? [{
|
|
64
|
-
url: process.env.MUND_WEBHOOK_URL,
|
|
65
|
-
method: 'POST',
|
|
66
|
-
headers: process.env.MUND_WEBHOOK_HEADERS ? JSON.parse(process.env.MUND_WEBHOOK_HEADERS) : undefined,
|
|
67
|
-
min_severity: process.env.MUND_WEBHOOK_MIN_SEVERITY || 'high'
|
|
68
|
-
}] : undefined
|
|
69
|
-
}
|
|
70
|
-
};
|
|
71
|
-
return config;
|
|
72
|
-
}
|
|
73
|
-
// ============================================================================
|
|
74
|
-
// Threat Intelligence Tool Registration
|
|
75
|
-
// ============================================================================
|
|
76
|
-
function registerThreatIntelTools(server) {
|
|
77
|
-
const handlers = createThreatIntelToolHandlers(threatIntel);
|
|
78
|
-
// Map tool names to schemas
|
|
79
|
-
const schemaMap = {
|
|
80
|
-
'mund_update_threat_intel': UpdateThreatIntelSchema,
|
|
81
|
-
'mund_list_intel_sources': ListIntelSourcesSchema,
|
|
82
|
-
'mund_intel_status': IntelStatusSchema,
|
|
83
|
-
'mund_add_intel_source': AddIntelSourceSchema,
|
|
84
|
-
'mund_remove_intel_source': RemoveIntelSourceSchema,
|
|
85
|
-
'mund_threat_scan': ThreatScanSchema,
|
|
86
|
-
'mund_list_patterns': ListPatternsSchema,
|
|
87
|
-
'mund_toggle_pattern': TogglePatternSchema,
|
|
88
|
-
};
|
|
89
|
-
// Register each threat intel tool with Zod schema
|
|
90
|
-
for (const tool of threatIntelTools) {
|
|
91
|
-
const schema = schemaMap[tool.name];
|
|
92
|
-
if (!schema)
|
|
93
|
-
continue;
|
|
94
|
-
server.tool(tool.name, tool.description, schema, async (args) => {
|
|
95
|
-
const handler = handlers[tool.name];
|
|
96
|
-
if (!handler) {
|
|
97
|
-
return {
|
|
98
|
-
content: [{ type: 'text', text: JSON.stringify({ error: `Unknown tool: ${tool.name}` }) }]
|
|
99
|
-
};
|
|
100
|
-
}
|
|
101
|
-
try {
|
|
102
|
-
const result = await handler(args);
|
|
103
|
-
return {
|
|
104
|
-
content: [{ type: 'text', text: JSON.stringify(result, null, 2) }]
|
|
105
|
-
};
|
|
106
|
-
}
|
|
107
|
-
catch (error) {
|
|
108
|
-
return {
|
|
109
|
-
content: [{ type: 'text', text: JSON.stringify({
|
|
110
|
-
error: error instanceof Error ? error.message : String(error)
|
|
111
|
-
}) }]
|
|
112
|
-
};
|
|
113
|
-
}
|
|
114
|
-
});
|
|
115
|
-
}
|
|
116
|
-
}
|
|
117
|
-
// ============================================================================
|
|
118
|
-
// Server Initialization
|
|
119
|
-
// ============================================================================
|
|
120
|
-
async function createMundServer(config) {
|
|
121
|
-
// Create MCP server
|
|
122
|
-
const server = new McpServer({
|
|
123
|
-
name: 'mund-mcp-server',
|
|
124
|
-
version: getVersion()
|
|
125
|
-
});
|
|
126
|
-
// Initialize storage
|
|
127
|
-
const storage = createStorage(config);
|
|
128
|
-
// Initialize analyzer engine
|
|
129
|
-
const analyzer = new AnalyzerEngine();
|
|
130
|
-
// Initialize notification hub
|
|
131
|
-
const notificationHub = new NotificationHub(config);
|
|
132
|
-
// Load rules (start with defaults, could be extended from file)
|
|
133
|
-
const rules = [...DEFAULT_RULES];
|
|
134
|
-
// Load any saved custom rules from storage
|
|
135
|
-
const savedRules = await storage.getRules();
|
|
136
|
-
for (const rule of savedRules) {
|
|
137
|
-
if (!rules.find(r => r.id === rule.id)) {
|
|
138
|
-
rules.push(rule);
|
|
139
|
-
}
|
|
140
|
-
}
|
|
141
|
-
// Register all core tools
|
|
142
|
-
loadCanariesFromEnv();
|
|
143
|
-
registerAllTools(server, storage, rules, analyzer, notificationHub, config.block_mode);
|
|
144
|
-
// Register threat intelligence tools
|
|
145
|
-
registerThreatIntelTools(server);
|
|
146
|
-
// Get threat intel status for logging
|
|
147
|
-
const intelStatus = threatIntel.getStatus();
|
|
148
|
-
// Log startup info
|
|
149
|
-
console.error(`Mund Guardian Protocol v0.2.0`);
|
|
150
|
-
console.error(`- Transport: ${config.transport}`);
|
|
151
|
-
console.error(`- Storage: ${config.storage_type}`);
|
|
152
|
-
console.error(`- Block Mode: ${config.block_mode ? 'enabled' : 'disabled'}`);
|
|
153
|
-
console.error(`- Rules Loaded: ${rules.filter(r => r.enabled).length}`);
|
|
154
|
-
console.error(`- Threat Intel: ${intelStatus.patterns.total} patterns from ${intelStatus.sources.enabled} sources`);
|
|
155
|
-
console.error(`- Notifiers: ${notificationHub.getNotifierNames().join(', ') || 'none'}`);
|
|
156
|
-
return server;
|
|
157
|
-
}
|
|
158
|
-
// ============================================================================
|
|
159
|
-
// Transport Handlers
|
|
160
|
-
// ============================================================================
|
|
161
|
-
async function runStdio(config) {
|
|
162
|
-
const server = await createMundServer(config);
|
|
163
|
-
const transport = new StdioServerTransport();
|
|
164
|
-
await server.connect(transport);
|
|
165
|
-
console.error('Mund MCP server running on stdio');
|
|
166
|
-
}
|
|
167
|
-
async function runHTTP(config) {
|
|
168
|
-
const server = await createMundServer(config);
|
|
169
|
-
const app = express();
|
|
170
|
-
app.use(express.json({ limit: '10mb' }));
|
|
171
|
-
// Health check endpoint
|
|
172
|
-
app.get('/health', (_req, res) => {
|
|
173
|
-
res.json({ status: 'ok', version: getVersion() });
|
|
174
|
-
});
|
|
175
|
-
// Threat intel status endpoint
|
|
176
|
-
app.get('/intel/status', (_req, res) => {
|
|
177
|
-
res.json(threatIntel.getStatus());
|
|
178
|
-
});
|
|
179
|
-
// MCP endpoint
|
|
180
|
-
app.post('/mcp', async (req, res) => {
|
|
181
|
-
const transport = new StreamableHTTPServerTransport({
|
|
182
|
-
sessionIdGenerator: undefined,
|
|
183
|
-
enableJsonResponse: true
|
|
184
|
-
});
|
|
185
|
-
res.on('close', () => transport.close());
|
|
186
|
-
await server.connect(transport);
|
|
187
|
-
await transport.handleRequest(req, res, req.body);
|
|
188
|
-
});
|
|
189
|
-
// Start server
|
|
190
|
-
app.listen(config.port, config.host, () => {
|
|
191
|
-
console.error(`Mund MCP server running on http://${config.host}:${config.port}/mcp`);
|
|
192
|
-
});
|
|
193
|
-
}
|
|
194
|
-
// ============================================================================
|
|
195
|
-
// CLI and Main
|
|
196
|
-
// ============================================================================
|
|
197
|
-
function printHelp() {
|
|
198
|
-
console.log(`
|
|
199
|
-
Mund - The Guardian Protocol
|
|
200
|
-
MCP-based security monitoring for agentic AI systems
|
|
201
|
-
|
|
202
|
-
Usage: mund-mcp [options] Run the MCP server
|
|
203
|
-
mund-mcp scan [paths...] Scan files (see: mund-mcp scan --help)
|
|
204
|
-
mund-mcp agent-audit Audit installed skills + MCP servers
|
|
205
|
-
mund-mcp check-skill <path> Scan a skill before installing it
|
|
206
|
-
|
|
207
|
-
Options:
|
|
208
|
-
--help, -h Show this help message
|
|
209
|
-
--version, -v Show version number
|
|
210
|
-
--transport <type> Transport type: stdio (default) or http
|
|
211
|
-
--port <port> HTTP port (default: 3000)
|
|
212
|
-
--host <host> HTTP host (default: 127.0.0.1)
|
|
213
|
-
--block Enable block mode (block dangerous content)
|
|
214
|
-
|
|
215
|
-
Environment Variables:
|
|
216
|
-
MUND_PORT HTTP server port
|
|
217
|
-
MUND_HOST HTTP server host
|
|
218
|
-
MUND_TRANSPORT Transport type (stdio or http)
|
|
219
|
-
MUND_LOG_LEVEL Log level (debug, info, warn, error)
|
|
220
|
-
MUND_STORAGE Storage type (memory, sqlite, postgres)
|
|
221
|
-
MUND_DATABASE_URL Database connection URL
|
|
222
|
-
MUND_BLOCK_MODE Set to 'block' to enable blocking
|
|
223
|
-
MUND_API_KEY API key for authentication
|
|
224
|
-
|
|
225
|
-
MUND_SLACK_WEBHOOK Slack webhook URL
|
|
226
|
-
MUND_SLACK_CHANNEL Slack channel override
|
|
227
|
-
MUND_SLACK_MIN_SEVERITY Minimum severity for Slack alerts
|
|
228
|
-
|
|
229
|
-
MUND_TEAMS_WEBHOOK Microsoft Teams webhook URL
|
|
230
|
-
MUND_TEAMS_MIN_SEVERITY Minimum severity for Teams alerts
|
|
231
|
-
|
|
232
|
-
MUND_EMAIL_SMTP_HOST SMTP server host
|
|
233
|
-
MUND_EMAIL_SMTP_PORT SMTP server port
|
|
234
|
-
MUND_EMAIL_FROM From address for emails
|
|
235
|
-
MUND_EMAIL_TO Comma-separated recipient addresses
|
|
236
|
-
|
|
237
|
-
MUND_WEBHOOK_URL Generic webhook URL
|
|
238
|
-
MUND_WEBHOOK_HEADERS JSON string of webhook headers
|
|
239
|
-
|
|
240
|
-
Threat Intelligence:
|
|
241
|
-
Built-in threat patterns with MITRE ATT&CK mapping.
|
|
242
|
-
Use mund_intel_status to check coverage.
|
|
243
|
-
Use mund_update_threat_intel to pull latest patterns.
|
|
244
|
-
|
|
245
|
-
Examples:
|
|
246
|
-
# Run as stdio server (for MCP clients)
|
|
247
|
-
mund-mcp
|
|
248
|
-
|
|
249
|
-
# Run as HTTP server
|
|
250
|
-
mund-mcp --transport http --port 3000
|
|
251
|
-
|
|
252
|
-
# Run with Slack notifications
|
|
253
|
-
MUND_SLACK_WEBHOOK=https://hooks.slack.com/... mund-mcp
|
|
254
|
-
|
|
255
|
-
# Run in block mode
|
|
256
|
-
mund-mcp --block
|
|
257
|
-
|
|
258
|
-
For more information, visit: https://github.com/Tyox-all/Weave_Protocol
|
|
259
|
-
`);
|
|
260
|
-
}
|
|
261
|
-
async function main() {
|
|
262
|
-
const args = process.argv.slice(2);
|
|
263
|
-
if (args[0] === 'scan') {
|
|
264
|
-
process.exit(await runScanCli(args.slice(1)));
|
|
265
|
-
}
|
|
266
|
-
if (args[0] === 'agent-audit') {
|
|
267
|
-
process.exit(await runAgentAuditCli(args.slice(1)));
|
|
268
|
-
}
|
|
269
|
-
if (args[0] === 'check-skill') {
|
|
270
|
-
process.exit(await runCheckSkillCli(args.slice(1)));
|
|
271
|
-
}
|
|
272
|
-
// Parse CLI arguments
|
|
273
|
-
if (args.includes('--help') || args.includes('-h')) {
|
|
274
|
-
printHelp();
|
|
275
|
-
process.exit(0);
|
|
276
|
-
}
|
|
277
|
-
if (args.includes('--version') || args.includes('-v')) {
|
|
278
|
-
console.log(getVersion());
|
|
279
|
-
process.exit(0);
|
|
280
|
-
}
|
|
281
|
-
// Load config
|
|
282
|
-
const config = loadConfig();
|
|
283
|
-
// Override from CLI
|
|
284
|
-
const transportIndex = args.indexOf('--transport');
|
|
285
|
-
if (transportIndex !== -1 && args[transportIndex + 1]) {
|
|
286
|
-
config.transport = args[transportIndex + 1];
|
|
287
|
-
}
|
|
288
|
-
const portIndex = args.indexOf('--port');
|
|
289
|
-
if (portIndex !== -1 && args[portIndex + 1]) {
|
|
290
|
-
config.port = parseInt(args[portIndex + 1]);
|
|
291
|
-
}
|
|
292
|
-
const hostIndex = args.indexOf('--host');
|
|
293
|
-
if (hostIndex !== -1 && args[hostIndex + 1]) {
|
|
294
|
-
config.host = args[hostIndex + 1];
|
|
295
|
-
}
|
|
296
|
-
if (args.includes('--block')) {
|
|
297
|
-
config.block_mode = true;
|
|
298
|
-
}
|
|
299
|
-
// Run appropriate transport
|
|
300
|
-
try {
|
|
301
|
-
if (config.transport === 'http') {
|
|
302
|
-
await runHTTP(config);
|
|
303
|
-
}
|
|
304
|
-
else {
|
|
305
|
-
await runStdio(config);
|
|
306
|
-
}
|
|
307
|
-
}
|
|
308
|
-
catch (error) {
|
|
309
|
-
console.error('Failed to start Mund server:', error);
|
|
310
|
-
process.exit(1);
|
|
311
|
-
}
|
|
312
|
-
}
|
|
313
|
-
// Run
|
|
314
|
-
main().catch(error => {
|
|
315
|
-
console.error('Fatal error:', error);
|
|
316
|
-
process.exit(1);
|
|
317
|
-
});
|
|
318
|
-
// ============================================================================
|
|
319
|
-
// Exports for programmatic use
|
|
320
|
-
// ============================================================================
|
|
321
5
|
export { ThreatIntelManager, threatIntel } from './threat-intel-manager.js';
|
|
322
6
|
export { threatIntelTools, createThreatIntelToolHandlers } from './threat-intel-tools.js';
|
|
323
7
|
export * from './threat-intel-types.js';
|
|
8
|
+
// Scanning
|
|
9
|
+
export { scan, SCAN_TYPES } from './scan.js';
|
|
10
|
+
export { AnalyzerEngine, getAnalyzers, SecretScanner, PIIDetector, CodeAnalyzer, InjectionDetector, ExfiltrationDetector, McpServerAnalyzer, } from './analyzers/index.js';
|
|
11
|
+
export { DEFAULT_RULES } from './constants.js';
|
|
12
|
+
export { computeRiskScore, labelForScore } from './scoring.js';
|
|
13
|
+
// Importing this module has no side effects. Run directly (`node dist/index.js`,
|
|
14
|
+
// as older MCP configs do), it still starts the server; the bin points at server.js.
|
|
15
|
+
import { realpathSync } from 'node:fs';
|
|
16
|
+
import { fileURLToPath } from 'node:url';
|
|
17
|
+
const invokedDirectly = (() => {
|
|
18
|
+
try {
|
|
19
|
+
return !!process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
|
|
20
|
+
}
|
|
21
|
+
catch {
|
|
22
|
+
return false;
|
|
23
|
+
}
|
|
24
|
+
})();
|
|
25
|
+
if (invokedDirectly)
|
|
26
|
+
void import('./server.js');
|
|
324
27
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC1F,cAAc,yBAAyB,CAAC;AAExC,WAAW;AACX,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EACL,cAAc,EAAE,YAAY,EAC5B,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,GACrG,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI/D,iFAAiF;AACjF,qFAAqF;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,IAAI,eAAe;IAAE,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC"}
|
package/dist/scan.d.ts
ADDED
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Library scan: the same analyzers and default rules as the mund_scan_content
|
|
3
|
+
* tool, returning issues plus a 0–100 risk score.
|
|
4
|
+
*/
|
|
5
|
+
import { type RiskScore } from './scoring.js';
|
|
6
|
+
import type { DetectionRule, SecurityIssue } from './types.js';
|
|
7
|
+
/** Friendly scan types → analyzer types. */
|
|
8
|
+
export declare const SCAN_TYPES: {
|
|
9
|
+
readonly secrets: readonly ["secret"];
|
|
10
|
+
readonly pii: readonly ["pii"];
|
|
11
|
+
readonly injection: readonly ["injection"];
|
|
12
|
+
readonly exfiltration: readonly ["exfiltration"];
|
|
13
|
+
readonly code: readonly ["code_pattern"];
|
|
14
|
+
};
|
|
15
|
+
export type ScanType = keyof typeof SCAN_TYPES;
|
|
16
|
+
export interface ScanOptions {
|
|
17
|
+
/** Limit to these scan types; default: all analyzers. */
|
|
18
|
+
types?: ScanType[];
|
|
19
|
+
/** Rules to apply; default: Mund's built-in rules. */
|
|
20
|
+
rules?: DetectionRule[];
|
|
21
|
+
}
|
|
22
|
+
export interface ScanResult {
|
|
23
|
+
issues: SecurityIssue[];
|
|
24
|
+
risk: RiskScore;
|
|
25
|
+
}
|
|
26
|
+
export declare function scan(content: string, options?: ScanOptions): Promise<ScanResult>;
|
|
27
|
+
//# sourceMappingURL=scan.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,4CAA4C;AAC5C,eAAO,MAAM,UAAU;;;;;;CAMb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,sDAAsD;IACtD,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,wBAAsB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ1F"}
|
package/dist/scan.js
ADDED
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Library scan: the same analyzers and default rules as the mund_scan_content
|
|
3
|
+
* tool, returning issues plus a 0–100 risk score.
|
|
4
|
+
*/
|
|
5
|
+
import { AnalyzerEngine, getAnalyzers } from './analyzers/index.js';
|
|
6
|
+
import { DEFAULT_RULES } from './constants.js';
|
|
7
|
+
import { computeRiskScore } from './scoring.js';
|
|
8
|
+
/** Friendly scan types → analyzer types. */
|
|
9
|
+
export const SCAN_TYPES = {
|
|
10
|
+
secrets: ['secret'],
|
|
11
|
+
pii: ['pii'],
|
|
12
|
+
injection: ['injection'],
|
|
13
|
+
exfiltration: ['exfiltration'],
|
|
14
|
+
code: ['code_pattern'],
|
|
15
|
+
};
|
|
16
|
+
export async function scan(content, options = {}) {
|
|
17
|
+
let analyzers = getAnalyzers();
|
|
18
|
+
if (options.types?.length) {
|
|
19
|
+
const wanted = new Set(options.types.flatMap((t) => SCAN_TYPES[t] ?? []));
|
|
20
|
+
analyzers = analyzers.filter((a) => wanted.has(a.type));
|
|
21
|
+
}
|
|
22
|
+
const issues = await new AnalyzerEngine(analyzers).analyzeAll(content, options.rules ?? DEFAULT_RULES);
|
|
23
|
+
return { issues, risk: computeRiskScore(issues) };
|
|
24
|
+
}
|
|
25
|
+
//# sourceMappingURL=scan.js.map
|
package/dist/scan.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,cAAc,CAAC;AAGhE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,YAAY,EAAE,CAAC,cAAc,CAAC;IAC9B,IAAI,EAAE,CAAC,cAAc,CAAC;CACd,CAAC;AAgBX,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAe,EAAE,UAAuB,EAAE;IACnE,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACvG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;AACpD,CAAC"}
|
package/dist/server.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;GAGG"}
|