@weave_protocol/mund 0.5.2 β†’ 0.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +89 -50
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -5,25 +5,51 @@
5
5
  [![npm version](https://img.shields.io/npm/v/@weave_protocol/mund.svg)](https://www.npmjs.com/package/@weave_protocol/mund)
6
6
  [![npm downloads](https://img.shields.io/npm/dm/@weave_protocol/mund.svg)](https://www.npmjs.com/package/@weave_protocol/mund)
7
7
  [![MCP Registry](https://img.shields.io/badge/MCP-Registry-blue)](https://registry.modelcontextprotocol.io/)
8
- [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
8
+ [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
9
9
 
10
10
  Mund (Old English: "protection, guardian") is a real-time security scanner for AI agent systems. It detects prompt injection, secrets, PII, dangerous code patterns, and data exfiltration attempts.
11
11
 
12
- **πŸ†• New in v0.3.1:** [Canary tokens](#-canary-tokens-system-prompt-leakage) catch leaked system prompts, and [rug-pull detection](#rug-pull-detection) flags MCP servers whose tools change after you approved them.
12
+ ## πŸ†• What's new
13
13
 
14
- **v0.3.0:** `mund-mcp scan` scans files on disk and outputs text, JSON, or **SARIF for GitHub code scanning**. It checks npm dependencies against **OSV.dev**, with an offline cache. Every scan gets a **0–100 risk score**, and the README adds [OWASP coverage tables](#️-owasp-coverage). This release also fixes 23 secret rules that had never matched anything.
14
+ **0.5.2: injection detection by intent.** Mund now looks for what an injection is trying to do, not one fixed phrase. That covers:
15
+ - overriding instructions, in six languages;
16
+ - hijacking the task;
17
+ - text written to an AI reader;
18
+ - hiding actions from the user;
19
+ - false authority;
20
+ - persona jailbreaks;
21
+ - extracting the system prompt;
22
+ - payment and exfiltration directives.
15
23
 
16
- **v0.2.0:** Automated threat intelligence with MITRE ATT&CK mapping and community feeds.
24
+ It also reads text a person never sees: hidden HTML, base64, Unicode tag characters, and words split by zero-width characters.
25
+
26
+ | Detected at medium or higher | 0.5.1 | 0.5.2 |
27
+ |---|---|---|
28
+ | [Lakera Gandalf](https://huggingface.co/datasets/Lakera/gandalf_ignore_instructions) injections | 17.9% | **65.2%** |
29
+ | [jackhhao](https://huggingface.co/datasets/jackhhao/jailbreak-classification) jailbreaks | 30.9% | **58.3%** |
30
+ | [deepset](https://huggingface.co/datasets/deepset/prompt-injections) prompt injections (mostly German) | 4.9% | **24.6%** |
31
+ | False positives, 466 benign prompts from those sets | 0 | **0** |
32
+
33
+ These sets were not used to write the rules. A fix to the `shell_injection` rule also stops it flagging every line that contains braces. See [what the injection rules look for](#what-the-injection-rules-look-for-052).
34
+
35
+ **0.5.0: library API.** `scan(content)` returns findings and a 0–100 risk score, using the same analyzers and rules as the MCP tool.
36
+
37
+ **0.4.0: pre-install checks.** Mund checks skills and MCP servers before they're installed. See [pre-install checks](#-pre-install-checks-for-skills-and-mcp-servers).
38
+
39
+ **Earlier:**
40
+ - 0.3.1 added [canary tokens](#-canary-tokens-system-prompt-leakage) and [rug-pull detection](#rug-pull-detection).
41
+ - 0.3.0 added `mund-mcp scan` with SARIF output, OSV.dev dependency checks and risk scores.
42
+ - 0.2.0 added threat intelligence with MITRE ATT&CK mapping.
17
43
 
18
44
  ## ✨ Features
19
45
 
20
46
  | Category | What It Detects |
21
47
  |----------|-----------------|
22
- | **Prompt Injection** | Role manipulation, instruction override, jailbreak attempts, hidden Unicode |
48
+ | **Prompt Injection** | Instruction override in six languages, task hijack, concealment, false authority, persona jailbreaks, system-prompt extraction, and text hidden in HTML, base64, Unicode tags or zero-width characters |
23
49
  | **Secrets** | API keys (OpenAI, Anthropic, AWS, GitHub, Stripe), tokens, private keys, database URLs |
24
50
  | **PII** | SSN, credit cards, emails, phone numbers, IP addresses |
25
- | **Code Patterns** | Shell injection, SQL injection, dangerous chmod, curl\|bash, eval |
26
- | **Exfiltration** | Suspicious URLs, DNS tunneling, base64-encoded data blocks |
51
+ | **Code Patterns** | Shell injection, SQL injection, dangerous chmod, curl\|bash, eval, plus requests to read credential files, dump the environment, clear security logs or escalate privileges |
52
+ | **Exfiltration** | Directives to send private data to a URL or address, URLs with `{SESSION_TOKEN}`-style placeholders, suspicious URLs, DNS tunneling, encoded data blocks |
27
53
  | **MCP Servers** | Malicious tool descriptions, typosquatting, dangerous permissions, embedded secrets |
28
54
  | **Dependencies** | Known-vulnerable npm packages in `package-lock.json`, via OSV.dev with an offline cache |
29
55
  | **Threat Intel** | 20+ built-in patterns, MITRE ATT&CK mapping, auto-updating community feeds |
@@ -60,16 +86,21 @@ Restart Claude Desktop. Mund's security tools are now available.
60
86
  ### Programmatic Usage
61
87
 
62
88
  ```typescript
63
- import { AnalyzerEngine, getAnalyzers } from '@weave_protocol/mund';
89
+ import { scan } from '@weave_protocol/mund';
64
90
 
65
- const engine = new AnalyzerEngine(getAnalyzers());
66
- const issues = await engine.analyzeAll(content, rules);
91
+ const { issues, risk } = await scan(untrustedText);
92
+ // risk: { score: 0-100, label: 'none' | 'low' | 'medium' | 'high' | 'critical', counts }
67
93
 
68
- if (issues.some(i => i.severity === 'critical')) {
69
- console.error('Critical security issues detected!');
94
+ if (risk.label === 'high' || risk.label === 'critical') {
95
+ throw new Error(`Blocked: ${issues.map(i => i.rule_name).join(', ')}`);
70
96
  }
97
+
98
+ // Only some analyzers, or your own rules
99
+ await scan(text, { types: ['injection', 'exfiltration'] });
71
100
  ```
72
101
 
102
+ Treat findings at `medium` or higher as actionable. `AnalyzerEngine`, the individual analyzers, `DEFAULT_RULES` and `computeRiskScore` are exported for lower-level use.
103
+
73
104
  ### Scan Files and Upload to GitHub Code Scanning
74
105
 
75
106
  `mund-mcp scan` checks files on disk, plus the npm dependencies in any
@@ -127,7 +158,7 @@ for severe findings and never goes past 100.
127
158
 
128
159
  ## 🧠 Automated Threat Intelligence
129
160
 
130
- **New in v0.2.0:** Mund includes automated threat intelligence with MITRE ATT&CK mapping and auto-updating community feeds.
161
+ Mund includes automated threat intelligence with MITRE ATT&CK mapping and auto-updating community feeds.
131
162
 
132
163
  ### Built-in Detection Patterns
133
164
 
@@ -527,26 +558,27 @@ MUND_WEBHOOK_URL=https://api.company.com/alerts
527
558
 
528
559
  ## πŸ“œ Detection Rules
529
560
 
530
- Mund uses YAML-based rules in `rules/default.yaml`. Example:
561
+ Mund's rules are built in and exported as `DEFAULT_RULES`. Add your own with the `mund_add_rule` tool, or pass them to `scan()`:
531
562
 
532
- ```yaml
533
- - id: openai_api_key
534
- name: OpenAI API Key
535
- type: secret
536
- severity: critical
537
- pattern: 'sk-[a-zA-Z0-9]{48}'
538
- action: alert
539
- enabled: true
540
-
541
- - id: prompt_injection_ignore
542
- name: Instruction Override Attempt
543
- type: injection
544
- severity: high
545
- pattern: 'ignore\s+(previous|all|prior)\s+instructions'
546
- action: alert
547
- enabled: true
563
+ ```typescript
564
+ import { scan, DEFAULT_RULES, type DetectionRule } from '@weave_protocol/mund';
565
+
566
+ const internalHost: DetectionRule = {
567
+ id: 'internal_hostname',
568
+ name: 'Internal hostname',
569
+ description: 'Mentions of our internal network',
570
+ type: 'exfiltration',
571
+ pattern: '(?i)\\b[a-z0-9-]+\\.corp\\.example\\.com\\b',
572
+ severity: 'medium',
573
+ action: 'alert',
574
+ enabled: true,
575
+ };
576
+
577
+ await scan(text, { rules: [...DEFAULT_RULES, internalHost] });
548
578
  ```
549
579
 
580
+ Patterns are JavaScript regular expressions. A leading `(?i)` makes one case-insensitive.
581
+
550
582
  ### What the injection rules look for (0.5.2)
551
583
 
552
584
  The injection rules look for intent, not a single phrase, and run on normalized text with zero-width characters removed and Unicode normalized. These families of rules fire on any phrasing that matches them:
@@ -602,14 +634,14 @@ Treat a hit at `medium` or higher as actionable. That is the threshold Weave's C
602
634
  β”‚ β”œβ”€β”€ mund_scan_mcp_server MCP server scanning β”‚
603
635
  β”‚ β”œβ”€β”€ mund_check_typosquatting Name verification β”‚
604
636
  β”‚ β”œβ”€β”€ mund_audit_mcp_permissions Permission audit β”‚
605
- β”‚ β”œβ”€β”€ mund_update_threat_intel Pull latest patterns [NEW] β”‚
606
- β”‚ β”œβ”€β”€ mund_intel_status Health & coverage [NEW] β”‚
607
- β”‚ β”œβ”€β”€ mund_list_intel_sources Show intel sources [NEW] β”‚
608
- β”‚ β”œβ”€β”€ mund_threat_scan Scan with intel [NEW] β”‚
609
- β”‚ β”œβ”€β”€ mund_add_intel_source Add custom feed [NEW] β”‚
610
- β”‚ β”œβ”€β”€ mund_remove_intel_source Remove feed [NEW] β”‚
611
- β”‚ β”œβ”€β”€ mund_list_patterns Browse patterns [NEW] β”‚
612
- β”‚ └── mund_toggle_pattern Enable/disable [NEW] β”‚
637
+ β”‚ β”œβ”€β”€ mund_update_threat_intel Pull latest patterns β”‚
638
+ β”‚ β”œβ”€β”€ mund_intel_status Health & coverage β”‚
639
+ β”‚ β”œβ”€β”€ mund_list_intel_sources Show intel sources β”‚
640
+ β”‚ β”œβ”€β”€ mund_threat_scan Scan with intel β”‚
641
+ β”‚ β”œβ”€β”€ mund_add_intel_source Add custom feed β”‚
642
+ β”‚ β”œβ”€β”€ mund_remove_intel_source Remove feed β”‚
643
+ β”‚ β”œβ”€β”€ mund_list_patterns Browse patterns β”‚
644
+ β”‚ └── mund_toggle_pattern Enable/disable β”‚
613
645
  β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€
614
646
  β”‚ Analyzers β”‚
615
647
  β”‚ β”œβ”€β”€ SecretScanner API keys, tokens, credentials β”‚
@@ -618,7 +650,7 @@ Treat a hit at `medium` or higher as actionable. That is the threshold Weave's C
618
650
  β”‚ β”œβ”€β”€ CodeAnalyzer Dangerous code patterns β”‚
619
651
  β”‚ β”œβ”€β”€ ExfiltrationDetector Data exfiltration attempts β”‚
620
652
  β”‚ β”œβ”€β”€ McpServerAnalyzer MCP manifest security β”‚
621
- β”‚ └── ThreatIntelManager MITRE ATT&CK patterns [NEW] β”‚
653
+ β”‚ └── ThreatIntelManager MITRE ATT&CK patterns β”‚
622
654
  β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€
623
655
  β”‚ Notifications β”‚
624
656
  β”‚ └── Slack, Teams, Email, Webhooks β”‚
@@ -627,24 +659,31 @@ Treat a hit at `medium` or higher as actionable. That is the threshold Weave's C
627
659
 
628
660
  ---
629
661
 
630
- ## πŸ”— Part of Weave Protocol
662
+ ## πŸ•ΈοΈ Part of Weave Protocol
631
663
 
632
- Mund is the security layer of the [Weave Protocol](https://github.com/Tyox-all/Weave_Protocol) security suite:
664
+ One [WARD.md](https://github.com/Tyox-all/Weave_Protocol) policy for every agent you run, locally or at scale, plus the tools around it.
633
665
 
634
- | Package | Purpose |
635
- |---------|---------|
636
- | **πŸ›‘οΈ Mund** | Security scanning, MCP server vetting, threat intelligence |
637
- | **πŸ›οΈ Hord** | Encrypted vault storage (Yoxallismus cipher) |
638
- | **βš–οΈ Domere** | Compliance & verification (PCI-DSS, ISO27001, GDPR) |
639
- | **πŸ‘₯ Witan** | Multi-agent consensus & governance |
640
- | **πŸ” Hundredmen** | Real-time MCP proxy & drift detection |
641
- | **πŸ”Œ API** | REST interface for all packages |
666
+ | Package | What it does |
667
+ |---|---|
668
+ | [Ward](https://www.npmjs.com/package/@weave_protocol/ward) | The WARD.md policy standard and the tool-call evaluator every adapter shares |
669
+ | [Mund](https://www.npmjs.com/package/@weave_protocol/mund) | Scans content for prompt injection, secrets, PII and exfiltration |
670
+ | [Hord](https://www.npmjs.com/package/@weave_protocol/hord) | Encrypted vaults, PII tokenization, sandboxes, capability tokens, attestations |
671
+ | [Dōmere](https://www.npmjs.com/package/@weave_protocol/domere) | Audit threads, compliance checkpoints, GDPR and CCPA records, anchoring |
672
+ | [Witan](https://www.npmjs.com/package/@weave_protocol/witan) | Multi-agent consensus and spending caps |
673
+ | [Hundredmen](https://www.npmjs.com/package/@weave_protocol/hundredmen) | MCP proxy that enforces WARD.md on tool calls |
674
+ | [Tollere](https://www.npmjs.com/package/@weave_protocol/tollere) | Supply-chain checks: typosquats, CVEs, suspicious version diffs |
675
+ | [Browser](https://www.npmjs.com/package/@weave_protocol/browser) | WARD.md and injection scanning for Playwright browser agents |
676
+ | Adapters | WARD.md in [Claude Code](https://www.npmjs.com/package/@weave_protocol/adapter-claudecode), [Antigravity](https://www.npmjs.com/package/@weave_protocol/adapter-antigravity), [MSAF](https://www.npmjs.com/package/@weave_protocol/adapter-msaf), [Gemini CLI](https://www.npmjs.com/package/@weave_protocol/adapter-geminicli), [Codex](https://www.npmjs.com/package/@weave_protocol/adapter-codex), [OpenCode](https://www.npmjs.com/package/@weave_protocol/adapter-opencode) and [Cursor](https://www.npmjs.com/package/@weave_protocol/adapter-cursor) |
677
+ | [Adversary](https://www.npmjs.com/package/@weave_protocol/adversary) Β· [AgentSecBench](https://www.npmjs.com/package/@weave_protocol/agentsecbench) | Red-team engine and locked benchmark |
678
+ | [API](https://www.npmjs.com/package/@weave_protocol/api) Β· [CLI](https://www.npmjs.com/package/@weave_protocol/cli) Β· [LangChain](https://www.npmjs.com/package/@weave_protocol/langchain) | REST API and dashboard, setup CLI, LangChain.js integration |
679
+ | [full](https://www.npmjs.com/package/@weave_protocol/full) | Every defensive package in one install |
680
+ | [Yoxallismus](https://www.npmjs.com/package/@weave_protocol/yoxallismus) | Post-quantum hybrid cipher (experimental beta) |
642
681
 
643
682
  ---
644
683
 
645
684
  ## πŸ“„ License
646
685
 
647
- MIT License - see [LICENSE](LICENSE)
686
+ Apache-2.0 β€” see [LICENSE](LICENSE)
648
687
 
649
688
  ---
650
689
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@weave_protocol/mund",
3
- "version": "0.5.2",
3
+ "version": "0.5.3",
4
4
  "description": "The Guardian Protocol - MCP-based security monitoring for agentic AI systems",
5
5
  "main": "dist/index.js",
6
6
  "bin": {