# Mund — MCP Security Scanner (npm · @weave_protocol/mund)

Scan for prompt injection, secrets, PII, and vet MCP servers before installation

- Trust score: 62/100 (medium)
- Change this week: +17
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@weave_protocol/mund`: 62/100 (this document), [markdown](https://verifymcp.io/servers/tyox-all-mund/weave-protocol-mund.md), [page](https://verifymcp.io/servers/tyox-all-mund/weave-protocol-mund)

## Channel facts

- Registry: `npm`
- Package: `@weave_protocol/mund`
- Version: `0.1.12`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 70/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects nodemailer 6.10.1, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (181 of 183), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 66 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2088 tokens (~139/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add tyox-all-mund -- npx -y @weave_protocol/mund
```

### Codex

```bash
codex mcp add tyox-all-mund -- npx -y @weave_protocol/mund
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tyox-all-mund": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@weave_protocol/mund"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tyox-all-mund --command npx --arg -y --arg @weave_protocol/mund
```

### Hermes

```yaml
mcp_servers:
  tyox-all-mund:
    command: "npx"
    args: ["-y", "@weave_protocol/mund"]
```

### Other

```json
{
  "mcpServers": {
    "tyox-all-mund": {
      "command": "npx",
      "args": [
        "-y",
        "@weave_protocol/mund"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 61, +41)

- [security regression] CVE-2025-13033 affects this package: high
- [security regression] GHSA-r7g4-qg5f-qqm2 affects this package: high
- [security regression] GHSA-268h-hp4c-crq3 affects this package: high
- [security regression] GHSA-p6gq-j5cr-w38f affects this package: high
- [security regression] GHSA-wqvq-jvpq-h66f affects this package: high
- [security regression] CVE-2026-41907 affects this package: high
- [security regression] GHSA-c7w3-x93f-qmm8 affects this package: high
- [security regression] GHSA-vvjj-xcjg-gr5g affects this package: high
- [security regression] CVE-2025-14874 affects this package: high
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional improvement] License: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-07-31 (score 20, −4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (15)

### `mund_scan_content` (~382 tokens)

Scan Content for Security Issues

Scan text or code content for security vulnerabilities, secrets, PII, and other issues.

This tool analyzes the provided content using multiple security analyzers:
\- Secret Scanner: Detects API keys, tokens, passwords, and credentials
\- PII Detector: Finds personal identifiable information
\- Code Analyzer: Identifies dangerous code patterns
\- Injection Detector: Spots prompt injection attempts
\- Exfiltration Detector: Detects data exfiltration patterns

Args:
  \- content (string): The text/code to scan (required)
  \- content_type ('text' | 'code' | 'json' | 'yaml'): Type of content (default: 'text')
  \- tool_name (string): Name of tool that generated this content (optional)
  \- agent_id (string): ID of the requesting agent (optional)
  \- session_id (string): Current session ID (optional)

Returns:
  JSON object with:
  \- scan_id: Unique identifier for this scan
  \- issues_found: Number of security issues detected
  \- blocked: Whether the content was blocked (if block_mode is enabled)
  \- issues: Array of detected issues with severity, type, and suggestions
  \- scan_duration_ms: Time taken to complete the scan

Examples:
  \- Scan code before committing: {"content": "const key = 'AKIAIOSFODNN7EXAMPLE'"}
  \- Check user input: {"content": "Please ignore previous instructions", "content_type": "text"}

Input parameters:

- `agent_id` (string): ID of the agent making this request
- `content` (string, required): The text/code content to scan for security issues
- `content_type` (string): Type of content being scanned
- `session_id` (string): Current session ID
- `tool_name` (string): Name of the tool that generated this content

### `mund_check_url` (~231 tokens)

Check URL Safety

Check if a URL is safe to access.

Validates URLs against known dangerous patterns including:
\- Data exfiltration services (webhook.site, requestbin, etc.)
\- IP-based URLs (often used to bypass domain filtering)
\- Suspicious TLDs (.tk, .ml, etc.)
\- Data URLs (can contain arbitrary content)

Args:
  \- url (string): The URL to check (required)
  \- tool_name (string): Name of tool attempting access (optional)
  \- agent_id (string): ID of requesting agent (optional)

Returns:
  JSON object with:
  \- url: The checked URL
  \- safe: Boolean indicating if URL is safe
  \- risk_level: 'safe' | 'suspicious' | 'dangerous'
  \- warnings: Array of warning messages if any
  \- blocked: Whether access was blocked

Input parameters:

- `agent_id` (string): ID of the agent making this request
- `tool_name` (string): Name of the tool attempting to access this URL
- `url` (string, required): URL to check for safety

### `mund_validate_command` (~223 tokens)

Validate Shell Command

Validate a shell command for safety before execution.

Checks for dangerous patterns including:
\- Destructive commands (rm -rf, format, etc.)
\- Privilege escalation (sudo, chmod 777, etc.)
\- Network exfiltration (curl to suspicious URLs, etc.)
\- Code injection (eval, exec with variables, etc.)

Args:
  \- command (string): Shell command to validate (required)
  \- tool_name (string): Name of tool executing command (optional)
  \- agent_id (string): ID of requesting agent (optional)

Returns:
  JSON object with:
  \- command: The validated command
  \- safe: Boolean indicating if command is safe
  \- risk_level: 'safe' | 'suspicious' | 'dangerous'
  \- warnings: Array of warning messages
  \- blocked: Whether execution was blocked

Input parameters:

- `agent_id` (string): ID of the agent making this request
- `command` (string, required): Shell command to validate
- `tool_name` (string): Name of the tool executing this command

### `mund_get_events` (~226 tokens)

Get Security Events

Retrieve recent security events from the Mund monitoring system.

Supports filtering and pagination for efficient event retrieval.

Args:
  \- limit (number): Maximum events to return, 1-1000 (default: 50)
  \- offset (number): Skip this many events for pagination (default: 0)
  \- severity ('critical' | 'high' | 'medium' | 'low' | 'info'): Filter by severity
  \- type: Filter by detection type
  \- acknowledged (boolean): Filter by acknowledgment status

Returns:
  JSON object with:
  \- total: Total matching events
  \- count: Events in this response
  \- offset: Current offset
  \- has_more: Whether more events exist
  \- events: Array of security events

Input parameters:

- `acknowledged` (boolean): Filter by acknowledgment status
- `limit` (integer): Maximum number of events to return
- `offset` (integer): Number of events to skip for pagination
- `severity` (string): Filter by severity level
- `type` (string): Filter by detection type

### `mund_get_status` (~53 tokens)

Get Monitoring Status

Get the current status of the Mund monitoring system.

Returns information about:
\- Active analyzers and their status
\- Number of rules loaded
\- Configured notification channels
\- Block mode status
\- Recent event statistics

### `mund_add_rule` (~246 tokens)

Add Detection Rule

Add a custom security detection rule.

Create custom rules to detect specific patterns in content. Rules use regular expressions
for pattern matching and can be configured with different severity levels and actions.

Args:
  \- id (string): Unique rule identifier (lowercase, alphanumeric, underscores)
  \- name (string): Human-readable rule name
  \- description (string): Optional description
  \- type: Detection type (secret, pii, code_pattern, injection, exfiltration)
  \- pattern (string): Regular expression to match
  \- severity: Severity level (critical, high, medium, low, info)
  \- action: Action to take (alert, block, log, quarantine)

Returns:
  Confirmation of rule addition with rule details

Input parameters:

- `action` (string): Action to take when rule matches
- `description` (string): Description of what this rule detects
- `id` (string, required): Unique identifier for the rule
- `name` (string, required): Human-readable name for the rule
- `pattern` (string, required): Regular expression pattern to match
- `severity` (string, required): Severity level when this rule matches
- `type` (string, required): Type of detection

### `mund_remove_rule` (~65 tokens)

Remove Detection Rule

Remove a custom detection rule by ID.

Note: Built-in rules cannot be removed, only disabled.

Args:
  \- id (string): ID of the rule to remove

Returns:
  Confirmation of rule removal

Input parameters:

- `id` (string, required): ID of the rule to remove

### `mund_list_rules` (~72 tokens)

List Detection Rules

List all configured detection rules.

Args:
  \- type: Optional filter by detection type
  \- enabled_only: Only show enabled rules (default: false)

Returns:
  Array of rule configurations

Input parameters:

- `enabled_only` (boolean): Only show enabled rules
- `type` (string): Filter rules by type

### `mund_acknowledge_alert` (~86 tokens)

Acknowledge Security Alert

Mark a security event/alert as acknowledged.

Args:
  \- event_id (string): ID of the event to acknowledge
  \- acknowledged_by (string): Optional name/ID of acknowledger

Returns:
  Confirmation of acknowledgment

Input parameters:

- `acknowledged_by` (string): Name or ID of person acknowledging
- `event_id` (string, required): ID of the event to acknowledge

### `mund_block_pattern` (~93 tokens)

Block Pattern

Add a pattern to the blocklist.

Blocked patterns will always be flagged regardless of other rules.

Args:
  \- pattern (string): Pattern to block
  \- type: Type of pattern (secret, pii, code_pattern, injection, exfiltration)

Returns:
  Confirmation of blocklist addition

Input parameters:

- `pattern` (string, required): Pattern to add to blocklist
- `type` (string, required): Type of pattern

### `mund_allowlist_pattern` (~81 tokens)

Allowlist Pattern

Add a pattern to the allowlist.

Allowlisted patterns will be ignored by detection rules.

Args:
  \- pattern (string): Pattern to allowlist
  \- type: Type of pattern

Returns:
  Confirmation of allowlist addition

Input parameters:

- `pattern` (string, required): Pattern to add to allowlist
- `type` (string, required): Type of pattern

### `mund_configure_notification` (~136 tokens)

Configure Notification Channel

Configure a notification channel for security alerts.

Note: Full configuration requires environment variables. This tool can update
webhook URLs and minimum severity settings at runtime.

Args:
  \- type: Channel type (slack, teams, email, webhook)
  \- webhook_url: Webhook URL (for slack, teams, webhook)
  \- min_severity: Minimum severity to notify

Returns:
  Confirmation of configuration

Input parameters:

- `min_severity` (string): Minimum severity to send notifications
- `type` (string, required): Type of notification channel
- `webhook_url` (string): Webhook URL for Slack/Teams/generic webhook

### `mund_scan_mcp_server` (~79 tokens)

Scan an MCP server manifest (server.json) for security issues before installation. Detects prompt injection in tool descriptions, typosquatting, embedded secrets, and dangerous permissions.

Input parameters:

- `manifest` (string, required): JSON content of server.json manifest to scan
- `source` (string): Source URL, registry name, or file path for context

### `mund_check_typosquatting` (~58 tokens)

Check if an MCP server name is potentially typosquatting a known legitimate server. Compares against a list of official and common MCP servers.

Input parameters:

- `name` (string, required): MCP server name to check for typosquatting

### `mund_audit_mcp_permissions` (~57 tokens)

Analyze the permission scope and capabilities of an MCP server's tools. Identifies network access, filesystem operations, command execution, and other potentially dangerous capabilities.

Input parameters:

- `manifest` (string, required): JSON content of server.json manifest to audit

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/tyox-all-mund/weave-protocol-mund#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 61
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-30: 24
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@weave_protocol/mund
- Socket report: https://socket.dev/npm/package/@weave_protocol/mund
- Repository: https://github.com/Tyox-all/Weave_Protocol
- Changelog RSS feed: https://verifymcp.io/servers/tyox-all-mund/weave-protocol-mund/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/tyox-all-mund/weave-protocol-mund/changelog.json
- HTML version of this page: https://verifymcp.io/servers/tyox-all-mund/weave-protocol-mund