QNSQY
Linux only, local: post-quantum CBOM scan, encrypt to public keys, verify. Takes no secrets
Runs on your computer
Mund — MCP Security Scanner
Overview
Description from the maker (original English)
Scan for prompt injection, secrets, PII, and vet MCP servers before installation
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiEarly↓ 1.4K/wk · ★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Cybersecurity
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- The registry lists no key to fill in.
You need
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"mund": {
"command": "npx",
"args": [
"-y",
"@weave_protocol/mund"
]
}
}
}Run this in your terminal
claude mcp add mund -- npx -y @weave_protocol/mundOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"mund": {
"command": "npx",
"args": [
"-y",
"@weave_protocol/mund"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"mund": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@weave_protocol/mund"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account Tyox-all, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Cybersecurityi
- More stars than 0% of the other 1002 servers in this category
- Published to the registry more recently than 7% of the other 1002 servers in this category
- Basic checks equal to or better than 100% of the other 1002 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Mund — MCP Security Scanner safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (0.1.12) reached the registry 8 months ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: QNSQY, Gluo, Seal Security
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Gluo
Free agent tools, no sign-in: browser flows, test inboxes, web extract, site and security scans.
Runs in the cloud✓ gluo.dev
Seal Security
Vulnerability management: scan projects, search sealed packages, manage sealing rules and reports.
Runs in the cloud✓ sealsecurity.io
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
🕸️ Weave_Protocol
Infrastructure security for AI agents. We attack what we defend.
Make agent behavior verifiable, auditable, and cryptographically provable across any harness, any platform. Built as a TypeScript monorepo with MCP integration, blockchain anchoring, and — as of Q4 — a published red-team engine that tests our own defenses.
The thesis: every security platform claims its defenses work. We're the first to publish the attacks that prove it. Same suite. Same scorecard. Same locked benchmark — applied to our own packages on every push and release, with the scorecard published in CI.
🚀 Get started in one command
npx @weave_protocol/cli initThe CLI detects your framework (LangChain, LlamaIndex, MCP, OpenAI, Anthropic, Microsoft, Google) and scaffolds the right security middleware for your stack. Or install everything at once:
npm install @weave_protocol/full🆕 What's New
🗓️ November 2026 update — hardening
🛡️ Agents can't switch off their own guardrails (Ward 0.3.3)
An agent with a broad write rule could rewrite the files that control it: WARD.md, its harness's hook and settings files, MCP server lists, or git hooks. This is the pattern behind Cursor's CurXecute (CVE-2025-54135), where injected content rewrote mcp.json. Every adapter now asks a human before an agent writes or deletes one of these, even when a rule like write: /repo/** covers it. To let an agent edit one, name that exact file in an allow rule.
🛡️ The API refuses DNS-rebinding requests (api 1.6.0)
A web page can point its own domain at 127.0.0.1 and call a local server from your browser. This is the class behind the Playwright MCP DNS-rebinding issue (CVE-2025-9611). On its default loopback bind, the API now answers only requests addressed to localhost, 127.0.0.1 or [::1]. Add other names with WEAVE_ALLOWED_HOSTS.
🛡️ Mund catches far more prompt injection (0.5.2)
Mund now looks for what an injection is trying to do, not one fixed phrase. The patterns cover:
- overriding instructions, in English, German, Spanish, French, Italian and Portuguese;
- hijacking the task;
- text addressed to an AI reader;
- hiding actions from the user;
- false authority;
- persona jailbreaks;
- extracting the system prompt;
- payment and data-exfiltration directives.
It also reads text a person never sees: hidden HTML, base64, invisible Unicode tag characters, and words split by zero-width characters. A precedence bug in the shell_injection rule, which flagged any line containing braces, is fixed.
| Measured on | Before (0.5.1) | After (0.5.2) | False positives |
|---|---|---|---|
| Lakera Gandalf injections, 112 | 17.9% | 65.2% | – |
| jackhhao jailbreaks, 139 + 123 benign | 30.9% | 58.3% | 0 of 123 |
| deepset prompt-injections train split, 203 + 343 benign (mostly German) | 4.9% | 24.6% | 0 of 343 |
| Our Adversary corpus, 68 + our benign corpus of 84 | 27.9% | 94.1% | 0 of 84 (was 8) |
The three public sets were never used to write the rules; only their totals were checked. Our own corpus was used, so its 94.1% is optimistic. A hit means at least one finding at medium severity or higher. Pattern matching has a ceiling: paraphrased and harmful-content requests still get through, which is where a classifier would come in.
⚔️ Self red-team on every push
CI now runs our own attack corpus through our own defenses, offline:
- Mund scans every Adversary payload, plus a benign corpus to count false positives.
- Ward decides the tool calls a coerced agent would make.
The scorecard goes to the job summary. CI fails if detection falls or false positives rise past the committed baseline. Today's numbers:
- Mund flags 94.1% of payloads, with 0 false positives.
- Ward decides 21 of 21 calls correctly.
🗓️ October 2026 update — what landed
A big stretch across offense, defense, and how releases ship. Highlights:
🛡️ Security fix: harness adapters now check the whole tool call (WARD-2026-001)
The Claude Code, Antigravity and MSAF adapters each checked only part of a tool call. They looked at one argument per tool and the first URL in a shell command, so some calls a WARD policy denies got through. Ward 0.2.0 adds one shared evaluator, evaluateToolCall, which all three now use. It checks:
- every path and URL argument;
- every URL and path in shell commands;
- traversal tricks.
An invalid WARD.md now blocks instead of switching enforcement off. Upgrade to adapter-claudecode 0.3.0, adapter-antigravity 0.3.0 or adapter-msaf 0.2.0.
🛡️ New: WARD.md in Cursor
@weave_protocol/adapter-cursor enforces WARD.md through Cursor's agent hooks: shell commands, file reads, MCP calls, and every other tool through preToolUse. Set it up with weave-ward-cursor init. It's live-checked in Cursor 3.28.7: a denied read and a denied write were both blocked. That makes seven harnesses enforcing the same WARD.md.
🛡️ New: WARD.md in OpenCode
@weave_protocol/adapter-opencode is an OpenCode plugin that enforces WARD.md on every tool call, so the same policy covers whichever model OpenCode runs, including DeepSeek, Kimi, Qwen or a local model. Add "@weave_protocol/adapter-opencode" to plugin in opencode.json. It's live-checked in OpenCode 1.19.5: a read of a denied file and a write outside the allowed folder were both blocked.
🛡️ New: WARD.md in Codex CLI
@weave_protocol/adapter-codex enforces WARD.md in OpenAI's Codex CLI through its PreToolUse hook. It checks shell commands, MCP calls, and the files each apply_patch edit touches. It's live-checked in Codex CLI 0.166.0: a denied cat and a denied apply_patch were both blocked. Set it up with weave-ward-codex init, then trust the hook with /hooks in Codex.
🛡️ New: WARD.md in Gemini CLI
@weave_protocol/adapter-geminicli enforces the same WARD.md in Gemini CLI through its BeforeTool hook. npm i -g @weave_protocol/adapter-geminicli && weave-gemini init sets it up. It's live-checked in Gemini CLI 0.66.0, where a read of a denied file was blocked before the model saw it.
📊 The dashboard shows real data
The operator dashboard (@weave_protocol/api 1.4.0) now shows what your agents actually did. Hundredmen, the Claude Code / Antigravity / MSAF adapters and the browser guard report each decision to the API once you set WEAVE_DASHBOARD_URL (and WEAVE_API_KEY) where your agents run. Only the decision and the tool name o
Only the beginning is shown; read the rest in the repo