Mund — MCP Security Scanner

🕸️ Weave_Protocol

Infrastructure security for AI agents. We attack what we defend.

[npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [npm] [License]

Make agent behavior verifiable, auditable, and cryptographically provable across any harness, any platform. Built as a TypeScript monorepo with MCP integration, blockchain anchoring, and — as of Q4 — a published red-team engine that tests our own defenses.

The thesis: every security platform claims its defenses work. We're the first to publish the attacks that prove it. Same suite. Same scorecard. Same locked benchmark — applied to our own packages, every release.

🚀 Get started in one command

npx @weave_protocol/cli init

The CLI detects your framework (LangChain, LlamaIndex, MCP, OpenAI, Anthropic, Microsoft, Google) and scaffolds the right security middleware for your stack. Or install everything at once:

npm install @weave_protocol/full

🆕 What's New

🗓️ October 2026 update — what landed

A big stretch across offense, defense, and how releases ship. Highlights:

🛡️ Security fix: harness adapters now check the whole tool call (WARD-2026-001)

The Claude Code, Antigravity and MSAF adapters each checked only part of a tool call. They looked at one argument per tool and the first URL in a shell command, so some calls a WARD policy denies got through. Ward 0.2.0 adds one shared evaluator, evaluateToolCall, which all three now use. It checks:

• every path and URL argument;
• every URL and path in shell commands;
• traversal tricks.

An invalid WARD.md now blocks instead of switching enforcement off. Upgrade to adapter-claudecode 0.3.0, adapter-antigravity 0.3.0 or adapter-msaf 0.2.0.

🛡️ Mund: 0.5 → 0.3

@weave_protocol/mund, our most-used package, newest release first.

📚 0.5.0: Mund as a library

import { scan } from '@weave_protocol/mund' runs the same analyzers and rules as the MCP server and returns masked findings with a 0–100 risk score. The Weave API now uses it for every scan.

🚪 0.4.x: skills and MCP servers are checked before they can act

Mund and the harness adapters now guard what your agent installs:

• Skills are scanned before install, including every file they ship: invisible Unicode that hides instructions from reviewers, prompt injection, data-exfiltration instructions, dangerous commands and embedded secrets.

• MCP servers are checked before they're used. Mund looks at how each server is launched (typosquatted packages, plain-HTTP or data-collection URLs, secrets written into config), connects to the ones you've approved, scans their tool descriptions, and watches for rug pulls: tools that change after you approved them.

• Enforced by hooks in Claude Code (weave-claude-code mund install) and Antigravity (weave-antigravity mund install). Calls to blocked servers are denied, flagged ones ask you first, and a poisoned skill is stopped before it's written.

• Every claim is a test. DETECTION_CLAIMS.md links each one to a fixture that CI checks.

• Safe by design: Mund never starts a server you haven't approved, or one whose package or URL it already distrusts.

• Antigravity WARD enforcement fixed (adapter 0.2.0). The original hook didn't match Antigravity's documented hook format, so WARD rules were likely not being enforced there. Re-run weave-antigravity init after upgrading.

• Live-checked in the Antigravity CLI (adapter 0.2.1). We ran the WARD and Mund hooks in real agy 1.4.11 sessions, which turned up three bugs, now fixed:

  • agy uses its own file tools (read_file, write_file, edit_file), which the adapter didn't recognise, so allowed reads were blocked and path rules never applied. Mund's skill check now covers these write tools too.
  • agy sometimes sends workspace-relative paths, which could slip past a deny rule like secrets/**. Paths are now resolved against the workspace before matching.
  • agy treats an empty {} hook reply as a deny, so the hooks now print nothing for allowed calls.

  In the live run, a read of secrets/token.txt was denied by its WARD rule, while reads and writes inside the allowed folders went through. Upgrade with npm i -g @weave_protocol/adapter-antigravity@latest.

Since 0.4.0: 0.4.1 ships the MCP SDK and zod security updates (no high or critical advisories remain), and 0.4.2 makes importing @weave_protocol/mund side-effect free: the MCP server now starts only from the mund-mcp command or when dist/index.js is run directly, never on import.

🐤 0.3.1: canary tokens and rug-pull detection

• Canary tokens (OWASP LLM07). Put a Mund canary in your system prompt, and any output that leaks it is flagged, even spaced out, base64-encoded, or reversed.
• MCP rug-pull detection (OWASP ASI04). Mund remembers each MCP server's tools when you first approve it and alerts when they change later. If a changed tool now looks malicious or asks to run commands, the verdict is DO_NOT_USE.
• Both features are backed by a fixture library with one test case per scenario. OWASP coverage is now 3/20 green for Mund alone and 10/20 across the Weave suite, with every green cell linked to its source.

🧬 0.3.0: the parity floor (details below)

• mund-mcp scan --format=sarif: findings appear as GitHub code-scanning alerts.
• Live dependency CVEs from OSV.dev, with an offline cache. Unchecked packages are reported as unchecked, never as clean.
• A 0–100 risk score with a severity label on every scan.
• OWASP coverage tables for the LLM Top 10 and the Agentic Top 10, marking honestly what's covered and what isn't.
• 23 secret-detection rules that had never matched anything (including AWS secret keys) are fixed.

Security hardening in the same release:

• Patched express, qs and proxy-addr, and updated the MCP SDK to 1.32.1. npm audit now reports 0 production vulnerabilities.
• Removed nodemailer, which carried a high-severity CVE and was never actually wired up. The email notifier now says plainly that it isn't implemented instead of silently dropping alerts.
• Mund has its first real test suite.

🏛️ Hord 0.2.0: a real sandbox, and a key bug fixed

• Sandbox isolation (0.1.9). Code runs with no network, writes only to its own folder, a scrubbed environment, and memory and CPU limits (sandbox-exec on macOS, bwrap on Linux). Each result reports what was enforced, and strict mode refuses to run without full isolation.
• Advisory HORD-2026-001 (high). Before 0.2.0, any master key that wasn't 64 hex characters, including the default, gave the same key on every install. Upgrade, or set a 64-hex-character key.
• Sealed vaults can be reopened. Sealing used to wipe the vault's only key.
• Usable as a library: vaults, capability tokens, redaction, the sandbox and attestations are now exported.

🔌 API 1.3.0: real packages, locked down

• Backed by Mund, Hord and Dōmere. Earlier versions simulated the sandbox and anchoring, and "encrypted" vault secrets with a fixed key. Endpoints that aren't implemented upstream now say so (501, 410).
• Fails closed (1.2.0). It listens on 127.0.0.1 by default, refuses a public address without WEAVE_API_KEY, requires the key on every route, and no longer sends CORS *.

🧹 Across the suite

• No critical or high npm advisories in any package, with the MCP SDK on 1.32. CI now builds, tests and audits all 18 packages.
• Importing a package no longer starts a server (Mund, Hord, Dōmere, Hundredmen, Witan, API); servers start from their commands. @weave_protocol/full 0.3.0 installs current versions of everything.
• Also fixed: Dōmere threads with hops failed verification (1.3.8), Witan couldn't be imported (1.1.2), and Tollere missed react-dom typosquats (0.2.4).

🔐 Yoxallismus 0.2.0-beta.0: Double Ratchet, and a wire format you can build on

@weave_protocol/yoxallismus@beta moves from a cipher toward a messaging protocol:

• Signal's Double Ratchet, started post-quantum. Conversations get fresh keys every message, and a stolen session stops working after one round trip (post-compromise security). Messages can arrive out of order or go missing. Sessions start from the hybrid X25519 + ML-KEM-768 key exchange, so no setup is needed beyond the recipient's public key.
• seal() / open() for one-shot encryption to a public key, with an optional cascade mode that layers AES-256-GCM inside ChaCha20-Poly1305 so data stays safe if either cipher falls.
• Wire format yoxall/2 is locked through 1.0, specified byte by byte, with test vectors that fail CI if anything drifts.
• Three security advisories, published openly. The biggest one: Hord's original YoxallismusCipher could never decrypt its own output. It's now deprecated (Hord 0.1.8), so unlock() fails loudly instead of returning the wrong bytes.

🎯 AgentSecBench 0.3.0: grade any model

• Any provider. agentsecbench run --real --provider=<id> --model=<id> grades a live model on the locked suite, whether it's Claude, GPT, Gemini, DeepSeek, Kimi, Qwen, GLM, or a local model through Ollama. Reports record the provider and model.
• Only complete runs get a grade. If a provider's quota runs out mid-suite, or any attack hits an API error, AgentSecBench refuses to grade the run rather than publish an inflated tier.

🎯 AgentSecBench 0.2.0, with a public results page

@weave_protocol/[email protected] turns benchmark runs into something you can publish and compare:

• Public results page. A leaderboard of tier-graded agents on the locked ASB-Browser-v1 suite. Results go up as summaries that strip every piece of attack evidence, so nothing an agent said or did during the run is published.
• Report schema v1.1. Each report carries a hash of the exact suite it ran, so two reports can prove they're comparable. It also records Adversary 0.3's dynamic-mutation results, including how many attacks landed only through a reworded variant.
• Suites that can't drift. Suites are checked against the attack corpus before a run, and the built-in suite is hash-locked, so an accidental edit fails CI instead of quietly changing the benchmark. Suites can also be loaded from JSON files.

⚔️ Adversary v0.4.0: test any model

• Any model provider. --provider=<id> --model=<id> runs the attack corpus against Claude, GPT, Gemini, DeepSeek, Kimi, Qwen, GLM, OpenRouter, Groq, Together, or a local model through Ollama or LM Studio. weave-adversary providers lists them and shows which keys are set. Verified live on Gemini 3.5 Flash: a full 68-attack run, plus dynamic mode with Gemini writing the variants.
• Fits free tiers. Overload and rate-limit errors are retried with backoff, and --rpm paces calls. When a free tier's daily quota runs out, the run stops and saves a scorecard marked as partial, rather than erroring through the remaining attacks.
• Cost stays honest. Models with no price on file report "unknown", not $0.

⚔️ Adversary v0.3.0

• Dynamic mutation (--dynamic). When a target refuses but still engages with an attack, an LLM writes a variant with the same intent and Adversary retries it. In the first live run on Claude Haiku 5.5, 2 of 5 attacks landed only through a variant, for $0.003 total. That tests whether a safeguard generalizes or only caught the original wording.
• Real-model mode works again. The previous default model, Claude 3.5 Haiku, was retired in Feb 2026, so every --real run had been failing. The default is now Claude Haiku 5.5, and the pricing table is corrected.
• No more false perfect scores. Attacks that hit an API error used to count as "blocked", so a run with no API access scored 100/100. Adversary now exits with the real error instead.
• Scorecard fixes. Findings record the agent's tool calls again, timeToExploit means conversation turns again, and --redact-evidence also scrubs the per-attempt evidence it used to leak.
• First test suite for Adversary, covering retry logic, v0.2 compatibility, and redaction.

🔏 How releases ship

• npm Trusted Publishing (OIDC). CI publishes without any long-lived npm token.
• CycloneDX SBOM and Sigstore attestations for every package published by publish-all.
• Hardened CI: Node 22 builds, npm pinned to 11, and GitHub Actions moved to Node 24 runtimes. publish.yml can now release any single package without republishing all 18.

⚔️ we attack what we defend

The first agent security platform to publish its own offensive engine. Two new packages flipped the suite from purely defensive to defense + offense in the same monorepo, validated against each other:

Trophy attacks — documented in-the-wild incidents reproduced in the corpus:

• 🏦 Atlan autonomous-fraud (Dec 2025) — first documented agent-driven financial fraud
• 🔒 EchoLeak (CVE-2025-32711) — Microsoft Copilot zero-click exfil
• 👻 Brave/Comet OTP exfil (2025) — browser agent secret leak via hidden CSS
• 🚫 Forcepoint false copyright (Apr 2026) — DoS via fake copyright claim

# Run the canonical benchmark against the demo target — proves the suite landsnpx @weave_protocol/agentsecbench run
# Or run the full 68-attack corpus directlynpx @weave_protocol/adversary demo
# v0.3: when a real model half-blocks an attack, generate a variant and retrynpx @weave_protocol/adversary demo --real --dynamic

Why this matters: every model release, every WARD policy change, every adapter update can be re-benchmarked against the same locked suite. Did your score regress? agentsecbench compare will show you. Does your WARD policy actually defend anything? --measure-ward-delta will tell you. This is how a category gets defined.

See Adversary README → · See AgentSecBench README → · See METHODOLOGY.md →

🛡️ Mund parity floor — plugs into GitHub code scanning

@weave_protocol/[email protected] now runs as a file scanner as well as an MCP server:

• mund-mcp scan --format=sarif: SARIF 2.1.0 output with GitHub security-severity, so findings show up as code-scanning alerts in any repo
• Live dependency CVEs from OSV.dev for npm lockfiles, with an on-disk cache for offline runs. Packages that couldn't be checked are reported as unchecked, never as clean
• 0–100 risk score with a severity label on every scan
• OWASP coverage tables for the LLM Top 10 (2025) and the Agentic Top 10, marking honestly what's covered, partly covered, or not covered
• Release supply chain: publish-all generates a CycloneDX SBOM per package and Sigstore-signed SBOM attestations for the exact tarball it publishes

npx @weave_protocol/mund scan . --format=sarif -o mund.sarif

This work also fixed 23 secret rules that had never matched anything, because they used PCRE (?i) syntax that JavaScript rejects.

💰 Q4 Governance — autonomous spending caps

Every enterprise agent question today is "what's my ceiling on this thing?" — measured in dollars, not just tool calls. @weave_protocol/[email protected] answers it. Per-window budgets (run / hour / day / week / month) that gate LLM calls and tool calls, with three actions: block, require approval/consensus, or notify.

Multi-provider LLM pricing built in — Anthropic, OpenAI, Google, and local (free). Per-tool amount caps (send_payment max $500/day). Interactive TTY approval prompt for human-in-loop terminals. Async callback for Slack/PagerDuty/custom UIs. Safe defaults — never silent approval in non-interactive contexts.

npx @weave_protocol/[email protected] spending caps         # inspect WARD.md capsnpx @weave_protocol/[email protected] spending simulate     # dry-run scenarios

# Extend your WARD.md:spending_limits:  - window: day    budget: { usd: 5.00 }    on_exceeded: require_approval  - window: run    budget: { tool_calls: 100 }    on_exceeded: block  - window: day    budget:      tools:        send_payment: { max_amount_usd: 500 }    on_exceeded: require_approval

Backward compatible with the existing behavioral_limits.maxCostUSD. In-memory storage in v1.1 with a pluggable interface for the v1.2 Redis/SQLite backends. Programmatic API via import { SpendingTracker } from '@weave_protocol/witan/spending'.

See Witan spending caps README →

🔐 Yoxallismus v2 — post-quantum cipher (open beta)

@weave_protocol/[email protected]: a post-quantum cryptographic composition layer built on NIST FIPS 203 (ML-KEM-768) hybridized with X25519. Sealed boxes (AES-256-GCM, or a cascade inside ChaCha20-Poly1305), and Signal's Double Ratchet for conversations with forward secrecy and post-compromise security. Composition, not invention: the primitives are standard, and the wire format (yoxall/2) is locked through 1.0.

# Explicit opt-in required — the beta tag is NOT installed by defaultnpm install @weave_protocol/yoxallismus@beta

import { generateHybridKeypair, publicKeyOf, seal, open, initiateSession, acceptSession, drEncrypt } from '@weave_protocol/yoxallismus';
const bob = generateHybridKeypair();
// One-shot: seal to Bob's public keyconst msg = open(bob, seal(publicKeyOf(bob), plaintext));
// Conversation: Double Ratchet, started from Bob's public key aloneconst alice = initiateSession(publicKeyOf(bob));const { session: bobSession } = acceptSession(bob, drEncrypt(alice, plaintext));

⚠️ EXPERIMENTAL — NOT AUDITED. Do not use for regulated, medical, financial, or legal data. Validation is via public use, forks, community verification, and responsible disclosure — not paid audit. See THREAT_MODEL.md and SECURITY.md before adopting.

Verify every claim yourself:

npx @weave_protocol/yoxallismus@beta --package weave-yoxall test         # 20 reproducible-claims testsnpx @weave_protocol/yoxallismus@beta --package weave-yoxall audit-self   # 5 known-attack vectorsnpx @weave_protocol/yoxallismus@beta --package weave-yoxall benchmark    # perf micro-benchmarks

Measured on Node 22, single-threaded: 3.1 ms hybrid keypair generation · 2.4 ms encap+decap · 0.024 ms AEAD (1 KB) — comfortably under the <5 ms target.

See Yoxallismus README →

🛡️ Four runtimes. Three vendors. One policy file.

The thesis was that WARD.md could be a portable agent security standard — write it once, enforce it everywhere. As of today, that's shipped and live across the entire agent harness landscape:

The same WARD.md file in your project root is now read and enforced by Anthropic's, Google's, Microsoft's, MCP's, and the browser harness's runtimes — without any platform-specific edits.

my-agent-project/├── AGENTS.md          # what the agent does├── SKILL.md           # how the agent does it└── WARD.md            # what the agent can't do  ← all five surfaces respect this

🌐 Browser agent security (Q3) — fifth enforcement surface

@weave_protocol/browser adds runtime IPI (indirect prompt injection) scanning to browser-driving agents. 33 detection patterns cover the documented threat surface: hidden CSS payloads, role-hijack directives, tool-call mimicry, action-injection directives, payment-recipient proximity patterns (Atlan), copyright-DoS markers (Forcepoint), and more.

Pair with the Browser Guard extension for client-side visibility into what your agent sees vs. what you see.

See browser README →

📊 State of AI Agent Security: Q3 2026 Report

Industry analysis of agent security trends, platform maturity, supply chain risks, and market gaps. Live at: tyox-all.github.io/Weave_Protocol/q3-2026.html

Previously shipped (Q3)

• adapter-msaf v0.1.0 — Microsoft Agent Framework enforcement via middleware. WardMiddleware class, one-line integration, Azure credential heuristic.
• adapter-antigravity v0.1.0 — Google Antigravity enforcement. One install protects desktop + agy CLI + SDK.
• adapter-claudecode v0.1.0 — Claude Code enforcement via PreToolUse hooks.
• Hundredmen v1.1.0 — WARD.md is now the first gate in the MCP decision flow, ahead of reputation/drift/approval.
• WARD.md v0.1.0 — Agent security policy standard. Ten domains: filesystem, network, capabilities, data boundaries, behavioral limits, multi-agent, compliance, verification, threat model, incident response. Spec →
• Tollere v0.2.2 — Multi-channel supply chain security. npm, PyPI, Cargo, Go, Maven, Docker Hub, VS Code Marketplace, Open VSX, JetBrains. Sandwich pattern detection.
• Weave CLI v0.1.0 + Full Bundle v0.1.0 — weave init / audit / dashboard / doctor. One-command security setup.

📦 Packages

The suite is now organized into three layers — defense, offensive, and operations. All 17 packages live on npm under the @weave_protocol scope, plus one Python package on PyPI.

🛡️ Defense Layer (12 packages)

The packages that keep your agent within policy: declare it, enforce it across every harness, scan everything that enters, encrypt everything that exits.

⚔️ Offensive Layer (2 packages) — NEW Q4

The red team. We attack what we defend.

🔧 Operations & Integrations (5 packages, plus 1 PyPI)

The front door, the dashboard, the bridges to other frameworks.

🤖 AI Agent Skills

Each package includes a SKILL.md file following the Claude Agent Skills specification. These teach AI agents how to use Weave Protocol tools effectively.

Installation:

The SKILL.md format is shared across Claude Code and Antigravity, so the same files work for both — only the install path differs.

git clone https://github.com/Tyox-all/Weave_Protocol.gitcd Weave_Protocol
# For Claude Code:mkdir -p ~/.claude/skills/weave-protocolcp */SKILL.md ~/.claude/skills/weave-protocol/
# For Google Antigravity (global, all sessions):mkdir -p ~/.gemini/antigravity-cli/skills/weave-protocolcp */SKILL.md ~/.gemini/antigravity-cli/skills/weave-protocol/
# Or per-project under .agents/:mkdir -p .agents/skills/weave-protocolcp /path/to/Weave_Protocol/*/SKILL.md .agents/skills/weave-protocol/

For Microsoft Agent Framework, skills aren't used — MSAF is code-level. Use the WardMiddleware class from @weave_protocol/adapter-msaf instead.

🚀 Quick Start

Option 1: Guided setup (recommended)

npx @weave_protocol/cli init

Option 2: Install everything

npm install @weave_protocol/full

Option 3: Install individual packages

npm install @weave_protocol/mund @weave_protocol/tollere @weave_protocol/ward

Option 4: Benchmark first, defend second

# See what attacks land on your agent before you start hardeningnpx @weave_protocol/agentsecbench run --measure-ward-delta

Claude Desktop Integration (MCP)

Add to claude_desktop_config.json:

{  "mcpServers": {    "mund":       { "command": "npx", "args": ["-y", "@weave_protocol/mund"] },    "hord":       { "command": "npx", "args": ["-y", "@weave_protocol/hord"] },    "domere":     { "command": "npx", "args": ["-y", "@weave_protocol/domere"] },    "hundredmen": { "command": "npx", "args": ["-y", "@weave_protocol/hundredmen"] },    "tollere":    { "command": "npx", "args": ["-y", "@weave_protocol/tollere"] }  }}

Claude Code / Antigravity / MSAF Integration

# Anthropicnpm install -g @weave_protocol/adapter-claudecode && weave-claude-code init
# Googlenpm install -g @weave_protocol/adapter-antigravity && weave-antigravity init
# Microsoft (code-level)npm install @weave_protocol/adapter-msaf

import { WardMiddleware } from '@weave_protocol/adapter-msaf';const ward = new WardMiddleware();agent.useFunctionMiddleware(ward.functionMiddleware());

Drop a WARD.md in your project root. Any (or all) of the adapters will gate every tool call.

✨ Package Details

🕸️ CLI — One Command for Everything

npx @weave_protocol/cli init        # detect framework, scaffold middlewarenpx @weave_protocol/cli audit       # supply chain scan (Tollere)npx @weave_protocol/cli dashboard   # launch monitoring UInpx @weave_protocol/cli doctor      # environment health check

📄 Skill: weave-cli

🛡️ Ward — The Policy Standard

WARD.md files declare what an agent is allowed to do, version-controlled alongside AGENTS.md and SKILL.md.

Enforced at runtime by five independent surfaces: Hundredmen (MCP), adapter-claudecode (Claude Code), adapter-antigravity (Antigravity), adapter-msaf (Microsoft Agent Framework), and browser (Browser agents).

📄 Skill: ward · 📋 Spec: WARD.md SPEC →

🛡️ The Harness Adapters

All four enforcement surfaces share the same WARD.md file. Pick the adapter(s) for your harness:

• adapter-claudecode — Claude Code via PreToolUse hooks
• adapter-antigravity — Google Antigravity (one install, three surfaces)
• adapter-msaf — Microsoft Agent Framework via middleware
• browser — Browser agents (Playwright/Stagehand/Puppeteer-driven), 33-pattern IPI scanner

WARD resolution (all adapters): $WEAVE_WARD_PATH → <cwd>/WARD.md → <cwd>/.weave/WARD.md → harness-specific user-global location.

🛡️ Mund — The Guardian

Real-time security scanning for AI agents. Catches secrets (30+ patterns), PII, prompt injection, dangerous code, malicious MCP server descriptions. Threat intel auto-updates from community feeds.

Also runs as a CLI: mund-mcp scan scans files on disk and checks npm dependencies against OSV.dev. It prints a 0–100 risk score and can output text, JSON, or SARIF for GitHub code scanning. See the OWASP coverage tables.

📄 Skill: security-scanning

🏛️ Hord — The Vault

Encrypted vault storage (AES-256-GCM), PII redaction and tokenization, sandboxed execution, capability tokens with delegation, and signed attestations. Its old YoxallismusCipher is deprecated: its output can't be decrypted (YOXALL-2026-003). Use the Yoxallismus package for encryption.

📄 Skill: encrypting-data

🔐 Yoxallismus — Post-Quantum Cipher (open beta)

Standalone post-quantum cryptographic composition layer. NIST FIPS 203 (ML-KEM-768) hybridized with X25519 for the KEM, AES-256-GCM (optionally cascaded inside ChaCha20-Poly1305) for AEAD, HKDF-SHA-256 for KDF, and Signal's Double Ratchet for sessions with forward secrecy and post-compromise security. Composition over invention: all primitives are NIST-standardized or de facto industry standard.

⚠️ EXPERIMENTAL. NOT AUDITED. Do not use for regulated, medical, financial, or legal data. Validation is via public use, forks, and responsible disclosure — not paid audit.

# Explicit opt-in required — beta tag not installed by defaultnpm install @weave_protocol/yoxallismus@beta
# CLI subcommandsweave-yoxall status         # library posture + known limitationsweave-yoxall keygen         # hybrid keypair (X25519 + ML-KEM-768)weave-yoxall encrypt        # encrypt to a recipient's public keyweave-yoxall decrypt        # decrypt with private keyweave-yoxall test           # reproducible-claims testsweave-yoxall audit-self     # known-attack test vectorsweave-yoxall benchmark      # perf micro-benchmarks

Performance — 3.1 ms hybrid keypair generation · 2.4 ms encap+decap · 0.024 ms AEAD (1 KB), all under the <5 ms target.

📄 Skill: pq-crypto · 📋 Threat model: THREAT_MODEL.md · 🔒 Disclosure: SECURITY.md

⚖️ Domere — The Judge

Enterprise-grade verification, orchestration, compliance, and audit infrastructure. SOC2, HIPAA, PCI-DSS, ISO27001, GDPR, CCPA. Solana and Ethereum blockchain anchoring for immutable audit trails.

Blockchain Anchoring:

• Solana Mainnet: 6g7raTAHU2h331VKtfVtkS5pmuvR8vMYwjGsZF1CUj2o
• Solana Devnet: BeCYVJYfbUu3k2TPGmh9VoGWeJwzm2hg2NdtnvbdBNCj
• Ethereum: 0xAA8b52adD3CEce6269d14C6335a79df451543820

📄 Skill: compliance-auditing

👥 Witan — The Council

Multi-agent consensus and governance. Unanimous, majority, weighted, and quorum protocols. Rule enforcement, escalation, agent bus.

New in v1.1.0 — autonomous spending caps. Per-window budgets on LLM cost, tokens, tool calls, and per-tool spend limits. Gated by three actions: block, require_approval, notify. Multi-provider LLM pricing built in (Anthropic, OpenAI, Google, local). Interactive TTY prompt or async callback for approval workflows. Safe defaults for non-interactive contexts.

npx @weave_protocol/witan spending caps        # inspect WARD.md spending capsnpx @weave_protocol/witan spending simulate    # dry-run scenarios

import { SpendingTracker } from '@weave_protocol/witan/spending';
const tracker = new SpendingTracker({  caps: [{ window: 'day', budget: { usd: 5.00 }, onExceeded: 'require_approval' }],});const check = await tracker.checkAction({ kind: 'tool', tool: 'send_payment', amountUSD: 1000 });if (check.blocked) throw new Error(check.reason);if (check.requiresApproval && !(await check.approve!())) throw new Error('denied');

📄 Skill: consensus-governance

🔍 Hundredmen — The Watchers

Real-time MCP security proxy. v1.1.0 enforces WARD.md as the first gate in the decision flow, ahead of reputation, drift, and approval checks.

📄 Skill: security-inspection

🛂 Tollere — The Customs Inspector

Supply chain security for AI-generated code. Catches malicious packages, Docker images, and IDE extensions before they reach node_modules/, your container, or your editor. npm, PyPI, Cargo, Go, Maven, Docker Hub, VS Code Marketplace, Open VSX, JetBrains.

📄 Skill: supply-chain-security

⚔️ Adversary — The Red Team

Where the other packages defend, Adversary attacks. 68 documented and novel attacks across 5 categories: IPI (33), tool-use coercion (15), jailbreak (10), extraction (5), goal corruption (5). Three targets: pattern-mock (CI smoke tests, no API), real-LLM (--real via Anthropic API, Claude Haiku 5.5 by default), and real-browser (Playwright with four breach signal channels: network, form, DOM, console). WARD-aware attack selection prioritizes probes against capabilities your policy claims to enforce.

v0.3 dynamic mutation (--dynamic): when a target refuses but still engages with an attack (a half-block), an LLM writes a variant with the same intent and Adversary retries, up to --dynamic-max-retries (default 2). This tests whether a safeguard generalizes or only caught the original wording. The corpus stays fixed. Every attempt is recorded in Finding.attempts[], and existing scorecard consumers keep working. In the first live run on Claude Haiku 5.5, 2 of 5 attacks landed only through a variant, for $0.003 total. If the API fails on every call, Adversary now exits with the error instead of reporting a clean score.

npx @weave_protocol/adversary demo               # mock, ~50msnpx @weave_protocol/adversary demo --real        # real LLM (Haiku 5.5)npx @weave_protocol/adversary demo --real --provider=deepseek --model=<id>   # any providernpx @weave_protocol/adversary demo --real --dynamic   # + LLM variants on half-blocksnpx @weave_protocol/adversary attack --url=...   # real browser agentnpx @weave_protocol/adversary demo --real --redact-evidence   # shareable scorecard

Locked scorecard schema v1.0 — consumed unchanged by AgentSecBench.

📄 Skill: adversarial-testing

🎯 AgentSecBench — The Benchmark

The interpretation layer on top of Adversary. Locked, versioned attack suites that produce tier-graded reports. ASB-Browser-v1 (v1.0) is 40 curated attacks: all 33 IPI + 4 critical tool-coercion + 3 highest-impact extraction.

npx @weave_protocol/agentsecbench run                          # default suite, tier-graded reportnpx @weave_protocol/agentsecbench run --measure-ward-delta     # quantify policy effectivenessnpx @weave_protocol/agentsecbench run --real --provider=gemini --model=<id>   # grade a live modelnpx @weave_protocol/agentsecbench compare baseline.json new.json

Tier grades A–F, four trophy attacks (Atlan, EchoLeak, Brave/Comet, Forcepoint), category gap analysis, optional WARD delta, plain-English interpretation prose. Reports are paste-ready Markdown — for blog posts, RFP responses, vendor audits, internal reviews.

📄 Skill: security-benchmarking · 📋 Methodology: METHODOLOGY.md →

🔌 API + Operator Dashboard

npx @weave_protocol/api# → http://localhost:3000/dashboard

Live monitoring across all five enforcement surfaces in one view. The dashboard renders WARD.md at the top of a hierarchy diagram, fanning out to your configured enforcers (Hundredmen + the three vendor adapters + browser). Surfaces you're not using appear dimmed, so it's instantly clear what's protecting your agent versus what's available.

Includes a live activity feed (allows / denies / IPI detections / approvals), a WARD policy panel, and 24-hour aggregate stats. Auto-refreshes every 5 seconds. Monochrome design — built for ops rooms, not marketing decks.

📄 Skill: weave-api-calling

🔗 Langchain — The Bridge

Security integration for LangChain.js applications. Drop-in callbacks, secured tool wrappers, RAG retriever scanning with PII redaction.

📄 Skill: langchain-security

🏗️ Architecture

flowchart TD    CLI["🕸️ <b>weave init / audit</b><br/><i>front door — @weave_protocol/cli</i>"]    WARD["🛡️ <b>WARD.md</b><br/><i>policy standard — declares what the agent can't do</i>"]    CLI --> WARD
    WARD -.->|enforced at runtime by| HM    WARD -.->|enforced at runtime by| CC    WARD -.->|enforced at runtime by| AG    WARD -.->|enforced at runtime by| MSAF    WARD -.->|enforced at runtime by| BR
    HM["🔍 <b>Hundredmen</b><br/>MCP layer<br/><i>open standard</i>"]    CC["🛡️ <b>adapter-claudecode</b><br/>Anthropic<br/>✅ Live"]    AG["🛡️ <b>adapter-antigravity</b><br/>Google · desktop + agy + SDK<br/>✅ Live"]    MSAF["🛡️ <b>adapter-msaf</b><br/>Microsoft · middleware<br/>✅ Live"]    BR["🌐 <b>browser</b><br/>Browser agents<br/>✅ Live"]
    CC -.->|Mund hooks: skills + MCP servers| MUND    AG -.->|Mund hooks: skills + MCP servers| MUND
    HM --> AGENT    CC --> AGENT    AG --> AGENT    MSAF --> AGENT    BR --> AGENT
    subgraph AGENT["🤖 AI Agent System"]        direction TB        subgraph CORE["Defense — Core security"]            direction LR            MUND["🛡️ Mund<br/>Guardian<br/><i>scanning · pre-install checks</i>"]            HORD["🏛️ Hord<br/>Vault<br/><i>secrets · isolated sandbox</i>"]            YOX["🔐 Yoxallismus<br/>PQ cipher<br/><i>beta</i>"]            DOMERE["⚖️ Domere<br/>Judge<br/><i>compliance</i>"]            WITAN["👥 Witan<br/>Council<br/><i>consensus</i>"]        end        subgraph OPS["Operations"]            direction LR            TOLLERE["🛂 Tollere<br/>Customs<br/><i>supply chain</i>"]            API["🔌 API + Dashboard<br/><i>REST + UI</i>"]            LC["🔗 LangChain bridge"]        end        CORE --> OPS    end
    subgraph OFFENSIVE["⚔️ Offensive — we attack what we defend"]        direction LR        MUT["🧬 <b>Dynamic mutation</b><br/>LLM variants on half-blocks<br/><i>v0.3</i>"]        ADV["⚔️ <b>Adversary</b><br/>68 attacks · 5 categories<br/><i>offensive engine</i>"]        MUT -.->|retries with variant| ADV        ASB["🎯 <b>AgentSecBench</b><br/>locked suites · tier A–F<br/><i>citable benchmark</i>"]        ADV --> ASB    end
    subgraph EXTERNAL["🌍 External integrations"]        direction LR        OSV["📚 OSV.dev<br/><i>dependency CVEs</i>"]        GHCS["📋 GitHub code scanning<br/><i>SARIF alerts</i>"]    end
    OSV -.->|advisories, cached offline| MUND    MUND -.->|SARIF 2.1.0| GHCS
    AGENT -.->|attacked by| OFFENSIVE    OFFENSIVE -.->|scorecards inform| WARD
    classDef policy fill:#1f2937,stroke:#60a5fa,stroke-width:2px,color:#fff    classDef enforcer fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#fff    classDef core fill:#312e81,stroke:#818cf8,stroke-width:1px,color:#fff    classDef ops fill:#1e3a8a,stroke:#60a5fa,stroke-width:1px,color:#fff    classDef offensive fill:#7f1d1d,stroke:#ef4444,stroke-width:2px,color:#fff    classDef external fill:#374151,stroke:#9ca3af,stroke-width:1px,color:#fff
    class CLI,WARD policy    class HM,CC,AG,MSAF,BR enforcer    class MUND,HORD,DOMERE,WITAN,YOX core    class TOLLERE,API,LC ops    class ADV,ASB,MUT offensive    class OSV,GHCS external

The diagram shows the loop. Defense surfaces enforce the policy at runtime. The offensive engine attacks the agent. Scorecards feed back into WARD as new evidence — what attacks land, which need new policy domains, what regressed since the last release. The loop is what makes the moat.

🔐 Security Model

Defense-in-depth across the entire AI agent lifecycle, validated continuously by an offensive engine that lives in the same monorepo:

1. 🛡️ Ward declares what the agent can and can't do (policy-as-code)
2. 🛡️ Harness adapters enforce WARD inside the IDE / CLI / framework:
   • adapter-claudecode for Claude Code (PreToolUse hooks)
   • adapter-antigravity for Google Antigravity (PreToolUse hooks across desktop/CLI/SDK)
   • adapter-msaf for Microsoft Agent Framework (middleware pipeline)
   • browser for browser-driving agents (runtime IPI scanning)
3. 🛂 Tollere inspects every dependency, image, and extension before it enters your project
4. 🛡️ Mund scans all inputs for threats before processing
5. 🏛️ Hord encrypts sensitive data at rest and in transit
6. ⚖️ Domere logs all actions with tamper-evident checksums and blockchain anchoring
7. 👥 Witan requires consensus for high-risk operations
8. 🔍 Hundredmen intercepts and gates tool calls in real-time — enforcing WARD policy at the MCP layer
9. 🔗 Langchain / Python secures LangChain.js and LlamaIndex chains and agents
10. ⚔️ Adversary attacks the entire stack with 68 documented and novel attacks
11. 🎯 AgentSecBench scores it, grades it A–F, and reports it in a standardized, citable format

CORS Model Integration

🛠️ Development

git clone https://github.com/Tyox-all/Weave_Protocol.gitcd Weave_Protocol
# Build each packagefor pkg in mund hord domere witan hundredmen tollere langchain api cli ward \           adapter-claudecode adapter-antigravity adapter-msaf browser \           adversary agentsecbench; do  (cd $pkg && npm install && npm run build)done

🗺️ Roadmap

Q1 2027: coming soon

The full Q1 2027 roadmap is on its way. Planned so far:

• More harness adapters. Codex CLI, Cursor, Gemini CLI and OpenCode, all enforcing the same WARD.md from a shared hook core.
• Model-endpoint guardrails. A WARD network rule and a Mund check that flag secrets or personal data sent to model endpoints your policy doesn't list.

Everything shipped through Q4 2026 is under What's New and in each package's README.

🤝 Contributing

Bug reports and feature requests welcome via GitHub Issues.

For security issues, please see SECURITY.md.

For all other inquiries: [email protected]

See CONTRIBUTING.md for guidelines.

📄 License

Apache 2.0 — See LICENSE

🔗 Links

• GitHub: https://github.com/Tyox-all/Weave_Protocol
• npm packages: https://www.npmjs.com/~tyox-all
• PyPI: https://pypi.org/project/weave-protocol-llamaindex/
• MCP Registry: https://registry.modelcontextprotocol.io (search "mund")
• Q3 2026 Report: https://tyox-all.github.io/Weave_Protocol/q3-2026.html
• Adversary on npm: https://www.npmjs.com/package/@weave_protocol/adversary
• AgentSecBench on npm: https://www.npmjs.com/package/@weave_protocol/agentsecbench

Built with ❤️ for the AI agent ecosystem. We attack what we defend.