Mund — MCP Security Scanner

🕸️ Weave_Protocol

Infrastructure security for AI agents. We attack what we defend.

Make agent behavior verifiable, auditable, and cryptographically provable across any harness, any platform. Built as a TypeScript monorepo with MCP integration, blockchain anchoring, and — as of Q4 — a published red-team engine that tests our own defenses.

The thesis: every security platform claims its defenses work. We're the first to publish the attacks that prove it. Same suite. Same scorecard. Same locked benchmark — applied to our own packages on every push and release, with the scorecard published in CI.

---

🚀 Get started in one command

npx @weave_protocol/cli init

The CLI detects your framework (LangChain, LlamaIndex, MCP, OpenAI, Anthropic, Microsoft, Google) and scaffolds the right security middleware for your stack. Or install everything at once:

npm install @weave_protocol/full

---

🆕 What's New

🗓️ November 2026 update — hardening

🛡️ Agents can't switch off their own guardrails (Ward 0.3.3)

An agent with a broad write rule could rewrite the files that control it: WARD.md, its harness's hook and settings files, MCP server lists, or git hooks. This is the pattern behind Cursor's CurXecute (CVE-2025-54135), where injected content rewrote mcp.json. Every adapter now asks a human before an agent writes or deletes one of these, even when a rule like write: /repo/** covers it. To let an agent edit one, name that exact file in an allow rule.

🛡️ The API refuses DNS-rebinding requests (api 1.6.0)

A web page can point its own domain at 127.0.0.1 and call a local server from your browser. This is the class behind the Playwright MCP DNS-rebinding issue (CVE-2025-9611). On its default loopback bind, the API now answers only requests addressed to localhost, 127.0.0.1 or [::1]. Add other names with WEAVE_ALLOWED_HOSTS.

🛡️ Mund catches far more prompt injection (0.5.2)

Mund now looks for what an injection is trying to do, not one fixed phrase. The patterns cover:

• overriding instructions, in English, German, Spanish, French, Italian and Portuguese;
• hijacking the task;
• text addressed to an AI reader;
• hiding actions from the user;
• false authority;
• persona jailbreaks;
• extracting the system prompt;
• payment and data-exfiltration directives.

It also reads text a person never sees: hidden HTML, base64, invisible Unicode tag characters, and words split by zero-width characters. A precedence bug in the shell_injection rule, which flagged any line containing braces, is fixed.

The three public sets were never used to write the rules; only their totals were checked. Our own corpus was used, so its 94.1% is optimistic. A hit means at least one finding at medium severity or higher. Pattern matching has a ceiling: paraphrased and harmful-content requests still get through, which is where a classifier would come in.

⚔️ Self red-team on every push

CI now runs our own attack corpus through our own defenses, offline:

• Mund scans every Adversary payload, plus a benign corpus to count false positives.
• Ward decides the tool calls a coerced agent would make.

The scorecard goes to the job summary. CI fails if detection falls or false positives rise past the committed baseline. Today's numbers:

• Mund flags 94.1% of payloads, with 0 false positives.
• Ward decides 21 of 21 calls correctly.

🗓️ October 2026 update — what landed

A big stretch across offense, defense, and how releases ship. Highlights:

🛡️ Security fix: harness adapters now check the whole tool call (WARD-2026-001)

The Claude Code, Antigravity and MSAF adapters each checked only part of a tool call. They looked at one argument per tool and the first URL in a shell command, so some calls a WARD policy denies got through. Ward 0.2.0 adds one shared evaluator, evaluateToolCall, which all three now use. It checks:

• every path and URL argument;
• every URL and path in shell commands;
• traversal tricks.

An invalid WARD.md now blocks instead of switching enforcement off. Upgrade to adapter-claudecode 0.3.0, adapter-antigravity 0.3.0 or adapter-msaf 0.2.0.

🛡️ New: WARD.md in Cursor

@weave_protocol/adapter-cursor enforces WARD.md through Cursor's agent hooks: shell commands, file reads, MCP calls, and every other tool through preToolUse. Set it up with weave-ward-cursor init. It's live-checked in Cursor 3.28.7: a denied read and a denied write were both blocked. That makes seven harnesses enforcing the same WARD.md.

🛡️ New: WARD.md in OpenCode

@weave_protocol/adapter-opencode is an OpenCode plugin that enforces WARD.md on every tool call, so the same policy covers whichever model OpenCode runs, including DeepSeek, Kimi, Qwen or a local model. Add "@weave_protocol/adapter-opencode" to plugin in opencode.json. It's live-checked in OpenCode 1.19.5: a read of a denied file and a write outside the allowed folder were both blocked.

🛡️ New: WARD.md in Codex CLI

@weave_protocol/adapter-codex enforces WARD.md in OpenAI's Codex CLI through its PreToolUse hook. It checks shell commands, MCP calls, and the files each apply_patch edit touches. It's live-checked in Codex CLI 0.166.0: a denied cat and a denied apply_patch were both blocked. Set it up with weave-ward-codex init, then trust the hook with /hooks in Codex.

🛡️ New: WARD.md in Gemini CLI

@weave_protocol/adapter-geminicli enforces the same WARD.md in Gemini CLI through its BeforeTool hook. npm i -g @weave_protocol/adapter-geminicli && weave-gemini init sets it up. It's live-checked in Gemini CLI 0.66.0, where a read of a denied file was blocked before the model saw it.

📊 The dashboard shows real data

The operator dashboard (@weave_protocol/api 1.4.0) now shows what your agents actually did. Hundredmen, the Claude Code / Antigravity / MSAF adapters and the browser guard report each decision to the API once you set WEAVE_DASHBOARD_URL (and WEAVE_API_KEY) where your agents run. Only the decision and the tool name o