Mund — MCP Security Scanner

Mark a security event/alert as acknowledged. Args: - event_id (string): ID of the event to acknowledge - acknowledged_by (string): Optional name/ID of acknowledger Returns: Confirmation of acknowledgment

Add a custom security detection rule. Create custom rules to detect specific patterns in content. Rules use regular expressions for pattern matching and can be configured with different severity levels and actions. Args: - id (string): Unique rule identifier (lowercase, alphanumeric, underscores) - name (string): Human-readable rule name - description (string): Optional description - type: Detection type (secret, pii, code_pattern, injection, exfiltration) - pattern (string): Regular expression to match - severity: Severity level (critical, high, medium, low, info) - action: Action to take (alert, block, log, quarantine) Returns: Confirmation of rule addition with rule details

Add a pattern to the allowlist. Allowlisted patterns will be ignored by detection rules. Args: - pattern (string): Pattern to allowlist - type: Type of pattern Returns: Confirmation of allowlist addition

Analyze the permission scope and capabilities of an MCP server's tools. Identifies network access, filesystem operations, command execution, and other potentially dangerous capabilities.

Add a pattern to the blocklist. Blocked patterns will always be flagged regardless of other rules. Args: - pattern (string): Pattern to block - type: Type of pattern (secret, pii, code_pattern, injection, exfiltration) Returns: Confirmation of blocklist addition

Check if an MCP server name is potentially typosquatting a known legitimate server. Compares against a list of official and common MCP servers.

Check if a URL is safe to access. Validates URLs against known dangerous patterns including: - Data exfiltration services (webhook.site, requestbin, etc.) - IP-based URLs (often used to bypass domain filtering) - Suspicious TLDs (.tk, .ml, etc.) - Data URLs (can contain arbitrary content) Args: - url (string): The URL to check (required) - tool_name (string): Name of tool attempting access (optional) - agent_id (string): ID of requesting agent (optional) Returns: JSON object with: - url: The checked URL - safe: Boolean indicating if URL is safe - risk_level: 'safe' | 'suspicious' | 'dangerous' - warnings: Array of warning messages if any - blocked: Whether access was blocked

Configure a notification channel for security alerts. Note: Full configuration requires environment variables. This tool can update webhook URLs and minimum severity settings at runtime. Args: - type: Channel type (slack, teams, email, webhook) - webhook_url: Webhook URL (for slack, teams, webhook) - min_severity: Minimum severity to notify Returns: Confirmation of configuration

Retrieve recent security events from the Mund monitoring system. Supports filtering and pagination for efficient event retrieval. Args: - limit (number): Maximum events to return, 1-1000 (default: 50) - offset (number): Skip this many events for pagination (default: 0) - severity ('critical' | 'high' | 'medium' | 'low' | 'info'): Filter by severity - type: Filter by detection type - acknowledged (boolean): Filter by acknowledgment status Returns: JSON object with: - total: Total matching events - count: Events in this response - offset: Current offset - has_more: Whether more events exist - events: Array of security events

Get the current status of the Mund monitoring system. Returns information about: - Active analyzers and their status - Number of rules loaded - Configured notification channels - Block mode status - Recent event statistics

List all configured detection rules. Args: - type: Optional filter by detection type - enabled_only: Only show enabled rules (default: false) Returns: Array of rule configurations

Remove a custom detection rule by ID. Note: Built-in rules cannot be removed, only disabled. Args: - id (string): ID of the rule to remove Returns: Confirmation of rule removal

Scan text or code content for security vulnerabilities, secrets, PII, and other issues. This tool analyzes the provided content using multiple security analyzers: - Secret Scanner: Detects API keys, tokens, passwords, and credentials - PII Detector: Finds personal identifiable information - Code Analyzer: Identifies dangerous code patterns - Injection Detector: Spots prompt injection attempts - Exfiltration Detector: Detects data exfiltration patterns Args: - content (string): The text/code to scan (required) - content_type ('text' | 'code' | 'json' | 'yaml'): Type of content (default: 'text') - tool_name (string): Name of tool that generated this content (optional) - agent_id (string): ID of the requesting agent (optional) - session_id (string): Current session ID (optional) Returns: JSON object with: - scan_id: Unique identifier for this scan - issues_found: Number of security issues detected - blocked: Whether the content was blocked (if block_mode is enabled) - issues: Array of detected issues with severity, type, and suggestions - scan_duration_ms: Time taken to complete the scan Examples: - Scan code before committing: {"content": "const key = 'AKIAIOSFODNN7EXAMPLE'"} - Check user input: {"content": "Please ignore previous instructions", "content_type": "text"}

Scan an MCP server manifest (server.json) for security issues before installation. Detects prompt injection in tool descriptions, typosquatting, embedded secrets, and dangerous permissions.

Validate a shell command for safety before execution. Checks for dangerous patterns including: - Destructive commands (rm -rf, format, etc.) - Privilege escalation (sudo, chmod 777, etc.) - Network exfiltration (curl to suspicious URLs, etc.) - Code injection (eval, exec with variables, etc.) Args: - command (string): Shell command to validate (required) - tool_name (string): Name of tool executing command (optional) - agent_id (string): ID of requesting agent (optional) Returns: JSON object with: - command: The validated command - safe: Boolean indicating if command is safe - risk_level: 'safe' | 'suspicious' | 'dangerous' - warnings: Array of warning messages - blocked: Whether execution was blocked