Mund — MCP Security Scanner

🕸️ Weave_Protocol

Infrastructure security for AI agents. We attack what we defend.

Make agent behavior verifiable, auditable, and cryptographically provable across any harness, any platform. Built as a TypeScript monorepo with MCP integration, blockchain anchoring, and — as of Q4 — a published red-team engine that tests our own defenses.

The thesis: every security platform claims its defenses work. We're the first to publish the attacks that prove it. Same suite. Same scorecard. Same locked benchmark — applied to our own packages, every release.

🚀 Get started in one command

npx @weave_protocol/cli init

The CLI detects your framework (LangChain, LlamaIndex, MCP, OpenAI, Anthropic, Microsoft, Google) and scaffolds the right security middleware for your stack. Or install everything at once:

npm install @weave_protocol/full

🆕 What's New

🗓️ October 2026 update — what landed

A big stretch across offense, defense, and how releases ship. Highlights:

⚔️ Adversary v0.3.0, on npm now

@weave_protocol/[email protected] is published.

• Dynamic mutation (--dynamic). When a target refuses but still engages with an attack, an LLM writes a variant with the same intent and Adversary retries it. In the first live run on Claude Haiku 5.5, 2 of 5 attacks landed only through a variant, for $0.003 total. That tests whether a safeguard generalizes or only caught the original wording.
• Real-model mode works again. The previous default model, Claude 3.5 Haiku, was retired in Feb 2026, so every --real run had been failing. The default is now Claude Haiku 5.5, and the pricing table is corrected.
• No more false perfect scores. Attacks that hit an API error used to count as "blocked", so a run with no API access scored 100/100. Adversary now exits with the real error instead.
• Scorecard fixes. Findings record the agent's tool calls again, timeToExploit means conversation turns again, and --redact-evidence also scrubs the per-attempt evidence it used to leak.
• First test suite for Adversary, covering retry logic, v0.2 compatibility, and redaction.

🛡️ Mund security hardening (in Mund 0.3.0)

• Patched express, qs and proxy-addr, and updated the MCP SDK to 1.32.1. npm audit now reports 0 production vulnerabilities.
• Removed nodemailer, which carried a high-severity CVE and was never actually wired up. The email notifier now says plainly that it isn't implemented instead of silently dropping alerts.
• Mund has its first real test suite.

🧬 Mund 0.3.0, on npm now (details below)

@weave_protocol/[email protected] ships the parity floor:

• mund-mcp scan --format=sarif: findings appear as GitHub code-scanning alerts.
• Live dependency CVEs from OSV.dev, with an offline cache. Unchecked packages are reported as unchecked, never as clean.
• A 0–100 risk score with a severity label on every scan.
• OWASP coverage tables for the LLM Top 10 and the Agentic Top 10, marking honestly what's covered and what isn't.
• 23 secret-detection rules that had never matched anything (including AWS secret keys) are fixed.

🐤 Mund 0.3.1: canary tokens and rug-pull detection

• Canary tokens (OWASP LLM07). Put a Mund canary in your system prompt, and any output that leaks it is flagged, even spaced out, base64-encoded, or reversed.
• MCP rug-pull detection (OWASP ASI04). Mund remembers each MCP server's tools when you first approve it and alerts when they change later. If a changed tool now looks malicious or asks to run commands, the verdict is DO_NOT_USE.
• Both features are backed by a fixture library with one test case per scenario. OWASP coverage is now 3/20 green for Mund alone and 10/20 across the Weave suite, with every green cell linked to its source.

🔏 How releases ship

• npm Trusted Publishing (OIDC). CI publishes without any long-lived npm token.
• CycloneDX SBOM and Sigstore attestations for every package published by publish-all.
• Hardened CI: Node 22 builds, npm pinned to 11, and GitHub Actions moved to Node 24 runtimes. publish.yml can now release any single package without republishing all 18.

⚔️ we attack what we defend

The first agent security platform to publish its own offensive engine. Two new packages flipped the suite from purely defensive to defense + offense in the same monorepo, validated against each other:

Trophy attacks — documented in-the-wild incidents reproduced in the corpus:

• 🏦 Atlan autonomous-fraud (Dec 2025) — first documented agent-driven financial fraud
• 🔒 EchoLeak (CVE-2025-32711) — Microsoft Copilot zero-click exfil
• 👻 Brave/Comet OTP exfil (2025) — browser agent secret leak via hidden CSS
• 🚫 Forcepoint false copyright (Apr 2026) — DoS via fake copyright claim

# Run the canonical benchmark against the demo target — proves the suite lands
npx @weave_protocol/agentsecbench run

# Or run the full 68-attack corpus directly
npx @weave_protocol/adversary demo

# v0.3: when a real model half-blocks an attack, generate a variant and retry
npx @weave_protocol/adversary demo --real --dynamic

Why this matters: every model release, every WARD policy change, every adapter update can be re-benchmarked against the same locked suite. Did your score regress? agentsecbench compare will show you. Does your WARD policy actually defend anything? --measure-ward-delta will tell you. This is how a category gets defined.

See Adversary README → · See AgentSecBench README → · See METHODOLOGY.md →

🛡️ Mund parity floor — plugs into GitHub code scanning

@weave_protocol/[email protected] now runs as a file scanner as well as an MCP server:

• mund-mcp scan --format=sarif: SARIF 2.1.0 output with GitHub security-severity, so findings show up as code-scanning alerts in any repo
• Live dependency CVEs from OSV.dev for npm lockfiles, with an on-disk cache for offline runs. Packages that couldn't be checked are reported as unchecked, never as clean
• 0–100 risk score with a severity label on every scan
• OWASP coverage tables for the LLM Top 10 (2025) and the Agentic Top 10, marking honestly what's covered, partly covered, or not covered
• Release supply chain: publish-all generates a CycloneDX SBOM per package and Sigstore-signed SBOM attestations for the exact tarball it publishes

npx @weave_protocol/mund scan . --format=sarif -o mund.sarif

This work also fixed 23 secret rules that had never matched anything, because they used PCRE (?i) syntax that JavaScript rejects.

💰 Q4 Governance — autonomous spending caps

Every enterprise agent question today is "what's my ceiling on this thing?" — measured in dollars, not just tool calls. @weave_protocol/[email protected] answers it. Per-window budgets (run / hour / day / week / month) that gate LLM calls and tool calls, with three actions: block, require approval/consensus, or notify.

Multi-provider LLM pricing built in — Anthropic, OpenAI, Google, and local (free). Per-tool amount caps (send_payment max $500/day). Interactive TTY approval prompt for human-in-loop terminals. Async callback for Slack/PagerDuty/custom UIs. Safe defaults — never silent approval in non-interactive contexts.

npx @weave_protocol/[email protected] spending caps         # inspect WARD.md caps
npx @weave_protocol/[email protected] spending simulate     # dry-run scenarios

# Extend your WARD.md:
spending_limits:
  - window: day
    budget: { usd: 5.00 }
    on_exceeded: require_approval
  - window: run
    budget: { tool_calls: 100 }
    on_exceeded: block
  - window: day
    budget:
      tools:
        send_payment: { max_amount_usd: 500 }
    on_exceeded: require_approval

Backward compatible with the existing behavioral_limits.maxCostUSD. In-memory storage in v1.1 with a pluggable interface for the v1.2 Redis/SQLite backends. Programmatic API via import { SpendingTracker } from '@weave_protocol/witan/spending'.

See Witan spending caps README →

🔐 Yoxallismus v2 — post-quantum cipher (open beta)

@weave_protocol/[email protected] — post-quantum cryptographic composition layer built on NIST FIPS 203 (ML-KEM-768) hybridized with X25519. AES-256-GCM AEAD, HKDF-SHA-256 KDF, symmetric ratchet for session forward secrecy. Composition, not invention — the primitives are NIST-standardized, the composition (PQ-hybrid KEM + agent-scoped context binding + ratcheting) is what's new.

# Explicit opt-in required — the beta tag is NOT installed by default
npm install @weave_protocol/yoxallismus@beta

import { PQCipher } from '@weave_protocol/yoxallismus';

const alice = PQCipher.generateKeypair();
const bundle = PQCipher.encryptTo(PQCipher.publicKeyOf(alice), plaintext);
const message = PQCipher.decryptFrom(alice, bundle.ciphertext, bundle.payload);

⚠️ EXPERIMENTAL — NOT AUDITED. Do not use for regulated, medical, financial, or legal data. Validation is via public use, forks, community verification, and responsible disclosure — not paid audit. See THREAT_MODEL.md and SECURITY.md before adopting.

Verify every claim yourself:

npx @weave_protocol/yoxallismus@beta --package weave-yoxall test         # 13 reproducible-claims tests
npx @weave_protocol/yoxallismus@beta --package weave-yoxall audit-self   # 5 known-attack vectors
npx @weave_protocol/yoxallismus@beta --package weave-yoxall benchmark    # perf micro-benchmarks

Measured on Node 22, single-threaded: 3.1 ms hybrid keypair generation · 2.4 ms encap+decap · 0.024 ms AEAD (1 KB) — comfortably under the <5 ms target.

See Yoxallismus README →

🛡️ Four runtimes. Three vendors. One policy file.

The thesis was that WARD.md could be a portable agent security standard — write it once, enforce it everywhere. As of today, that's shipped and live across the entire agent harness landscape:

The same WARD.md file in your project root is now read and enforced by Anthropic's, Google's, Microsoft's, MCP's, and the browser harness's runtimes — without any platform-specific edits.

my-agent-project/
├── AGENTS.md          # what the agent does
├── SKILL.md           # how the agent does it
└── WARD.md            # what the agent can't do  ← all five surfaces respect this

🌐 Browser agent security (Q3) — fifth enforcement surface

@weave_protocol/browser adds runtime IPI (indirect prompt injection) scanning to browser-driving agents. 33 detection patterns cover the documented threat surface: hidden CSS payloads, role-hijack directives, tool-call mimicry, action-injection directives, payment-recipient proximity patterns (Atlan), copyright-DoS markers (Forcepoint), and more.

Pair with the Browser Guard extension for client-side visibility into what your agent sees vs. what you see.

See browser README →

📊 State of AI Agent Security: Q3 2026 Report

Industry analysis of agent security trends, platform maturity, supply chain risks, and market gaps. Live at: tyox-all.github.io/Weave_Protocol/q3-2026.html

Previously shipped (Q3)

• adapter-msaf v0.1.0 — Microsoft Agent Framework enforcement via middleware. WardMiddleware class, one-line integration, Azure credential heuristic.
• adapter-antigravity v0.1.0 — Google Antigravity enforcement. One install protects desktop + agy CLI + SDK.
• adapter-claudecode v0.1.0 — Claude Code enforcement via PreToolUse hooks.
• Hundredmen v1.1.0 — WARD.md is now the first gate in the MCP decision flow, ahead of reputation/drift/approval.
• WARD.md v0.1.0 — Agent security policy standard. Ten domains: filesystem, network, capabilities, data boundaries, behavioral limits, multi-agent, compliance, verification, threat model, incident response. Spec →
• Tollere v0.2.2 — Multi-channel supply chain security. npm, PyPI, Cargo, Go, Maven, Docker Hub, VS Code Marketplace, Open VSX, JetBrains. Sandwich pattern detection.
• Weave CLI v0.1.0 + Full Bundle v0.1.0 — weave init / audit / dashboard / doctor. One-command security setup.

📦 Packages

The suite is now organized into three layers — defense, offensive, and operations. All 17 packages live on npm under the @weave_protocol scope, plus one Python package on PyPI.

🛡️ Defense Layer (12 packages)

The packages that keep your agent within policy: declare it, enforce it across every harness, scan everything that enters, encrypt everything that exits.

⚔️ Offensive Layer (2 packages) — NEW Q4

The red team. We attack what we defend.

🔧 Operations & Integrations (5 packages, plus 1 PyPI)

The front door, the dashboard, the bridges to other frameworks.

🤖 AI Agent Skills

Each package includes a SKILL.md file following the Claude Agent Skills specification. These teach AI agents how to use Weave Protocol tools effectively.

Installation:

The SKILL.md format is shared across Claude Code and Antigravity, so the same files work for both — only the install path differs.

git clone https://github.com/Tyox-all/Weave_Protocol.git
cd Weave_Protocol

# For Claude Code:
mkdir -p ~/.claude/skills/weave-protocol
cp */SKILL.md ~/.claude/skills/weave-protocol/

# For Google Antigravity (global, all sessions):
mkdir -p ~/.gemini/antigravity-cli/skills/weave-protocol
cp */SKILL.md ~/.gemini/antigravity-cli/skills/weave-protocol/

# Or per-project under .agents/:
mkdir -p .agents/skills/weave-protocol
cp /path/to/Weave_Protocol/*/SKILL.md .agents/skills/weave-protocol/

For Microsoft Agent Framework, skills aren't used — MSAF is code-level. Use the WardMiddleware class from @weave_protocol/adapter-msaf instead.

🚀 Quick Start

Option 1: Guided setup (recommended)

npx @weave_protocol/cli init

Option 2: Install everything

npm install @weave_protocol/full

Option 3: Install individual packages

npm install @weave_protocol/mund @weave_protocol/tollere @weave_protocol/ward

Option 4: Benchmark first, defend second

# See what attacks land on your agent before you start hardening
npx @weave_protocol/agentsecbench run --measure-ward-delta

Claude Desktop Integration (MCP)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mund":       { "command": "npx", "args": ["-y", "@weave_protocol/mund"] },
    "hord":       { "command": "npx", "args": ["-y", "@weave_protocol/hord"] },
    "domere":     { "command": "npx", "args": ["-y", "@weave_protocol/domere"] },
    "hundredmen": { "command": "npx", "args": ["-y", "@weave_protocol/hundredmen"] },
    "tollere":    { "command": "npx", "args": ["-y", "@weave_protocol/tollere"] }
  }
}

Claude Code / Antigravity / MSAF Integration

# Anthropic
npm install -g @weave_protocol/adapter-claudecode && weave-claude-code init

# Google
npm install -g @weave_protocol/adapter-antigravity && weave-antigravity init

# Microsoft (code-level)
npm install @weave_protocol/adapter-msaf

import { WardMiddleware } from '@weave_protocol/adapter-msaf';
const ward = new WardMiddleware();
agent.useFunctionMiddleware(ward.functionMiddleware());

Drop a WARD.md in your project root. Any (or all) of the adapters will gate every tool call.

✨ Package Details

🕸️ CLI — One Command for Everything

npx @weave_protocol/cli init        # detect framework, scaffold middleware
npx @weave_protocol/cli audit       # supply chain scan (Tollere)
npx @weave_protocol/cli dashboard   # launch monitoring UI
npx @weave_protocol/cli doctor      # environment health check

📄 Skill: weave-cli

🛡️ Ward — The Policy Standard

WARD.md files declare what an agent is allowed to do, version-controlled alongside AGENTS.md and SKILL.md.

Enforced at runtime by five independent surfaces: Hundredmen (MCP), adapter-claudecode (Claude Code), adapter-antigravity (Antigravity), adapter-msaf (Microsoft Agent Framework), and browser (Browser agents).

📄 Skill: ward · 📋 Spec: WARD.md SPEC →

🛡️ The Harness Adapters

All four enforcement surfaces share the same WARD.md file. Pick the adapter(s) for your harness:

• adapter-claudecode — Claude Code via PreToolUse hooks
• adapter-antigravity — Google Antigravity (one install, three surfaces)
• adapter-msaf — Microsoft Agent Framework via middleware
• browser — Browser agents (Playwright/Stagehand/Puppeteer-driven), 33-pattern IPI scanner

WARD resolution (all adapters): $WEAVE_WARD_PATH → <cwd>/WARD.md → <cwd>/.weave/WARD.md → harness-specific user-global location.

🛡️ Mund — The Guardian

Real-time security scanning for AI agents. Catches secrets (30+ patterns), PII, prompt injection, dangerous code, malicious MCP server descriptions. Threat intel auto-updates from community feeds.

Also runs as a CLI: mund-mcp scan scans files on disk and checks npm dependencies against OSV.dev. It prints a 0–100 risk score and can output text, JSON, or SARIF for GitHub code scanning. See the OWASP coverage tables.

📄 Skill: security-scanning

🏛️ Hord — The Vault

Encrypted storage with the Yoxallismus dual-tumbler cipher. AES-256-GCM, ChaCha20-Poly1305, Argon2id key derivation, secure memory handling.

📄 Skill: encrypting-data

🔐 Yoxallismus — Post-Quantum Cipher (open beta)

Standalone post-quantum cryptographic composition layer. NIST FIPS 203 (ML-KEM-768) hybridized with X25519 for the KEM, AES-256-GCM for AEAD, HKDF-SHA-256 for KDF, symmetric ratchet for session forward secrecy. Composition over invention — all primitives NIST-standardized or de facto industry standard.

⚠️ EXPERIMENTAL. NOT AUDITED. Do not use for regulated, medical, financial, or legal data. Validation is via public use, forks, and responsible disclosure — not paid audit.

# Explicit opt-in required — beta tag not installed by default
npm install @weave_protocol/yoxallismus@beta

# CLI subcommands
weave-yoxall status         # library posture + known limitations
weave-yoxall keygen         # hybrid keypair (X25519 + ML-KEM-768)
weave-yoxall encrypt        # encrypt to a recipient's public key
weave-yoxall decrypt        # decrypt with private key
weave-yoxall test           # reproducible-claims tests
weave-yoxall audit-self     # known-attack test vectors
weave-yoxall benchmark      # perf micro-benchmarks

Performance — 3.1 ms hybrid keypair generation · 2.4 ms encap+decap · 0.024 ms AEAD (1 KB), all under the <5 ms target.

📄 Skill: pq-crypto · 📋 Threat model: THREAT_MODEL.md · 🔒 Disclosure: SECURITY.md

⚖️ Domere — The Judge

Enterprise-grade verification, orchestration, compliance, and audit infrastructure. SOC2, HIPAA, PCI-DSS, ISO27001, GDPR, CCPA. Solana and Ethereum blockchain anchoring for immutable audit trails.

Blockchain Anchoring:

• Solana Mainnet: 6g7raTAHU2h331VKtfVtkS5pmuvR8vMYwjGsZF1CUj2o
• Solana Devnet: BeCYVJYfbUu3k2TPGmh9VoGWeJwzm2hg2NdtnvbdBNCj
• Ethereum: 0xAA8b52adD3CEce6269d14C6335a79df451543820

📄 Skill: compliance-auditing

👥 Witan — The Council

Multi-agent consensus and governance. Unanimous, majority, weighted, and quorum protocols. Rule enforcement, escalation, agent bus.

New in v1.1.0 — autonomous spending caps. Per-window budgets on LLM cost, tokens, tool calls, and per-tool spend limits. Gated by three actions: block, require_approval, notify. Multi-provider LLM pricing built in (Anthropic, OpenAI, Google, local). Interactive TTY prompt or async callback for approval workflows. Safe defaults for non-interactive contexts.

npx @weave_protocol/witan spending caps        # inspect WARD.md spending caps
npx @weave_protocol/witan spending simulate    # dry-run scenarios

import { SpendingTracker } from '@weave_protocol/witan/spending';

const tracker = new SpendingTracker({
  caps: [{ window: 'day', budget: { usd: 5.00 }, onExceeded: 'require_approval' }],
});
const check = await tracker.checkAction({ kind: 'tool', tool: 'send_payment', amountUSD: 1000 });
if (check.blocked) throw new Error(check.reason);
if (check.requiresApproval && !(await check.approve!())) throw new Error('denied');

📄 Skill: consensus-governance

🔍 Hundredmen — The Watchers

Real-time MCP security proxy. v1.1.0 enforces WARD.md as the first gate in the decision flow, ahead of reputation, drift, and approval checks.

📄 Skill: security-inspection

🛂 Tollere — The Customs Inspector

Supply chain security for AI-generated code. Catches malicious packages, Docker images, and IDE extensions before they reach node_modules/, your container, or your editor. npm, PyPI, Cargo, Go, Maven, Docker Hub, VS Code Marketplace, Open VSX, JetBrains.

📄 Skill: supply-chain-security

⚔️ Adversary — The Red Team

Where the other packages defend, Adversary attacks. 68 documented and novel attacks across 5 categories: IPI (33), tool-use coercion (15), jailbreak (10), extraction (5), goal corruption (5). Three targets: pattern-mock (CI smoke tests, no API), real-LLM (--real via Anthropic API, Claude Haiku 5.5 by default), and real-browser (Playwright with four breach signal channels: network, form, DOM, console). WARD-aware attack selection prioritizes probes against capabilities your policy claims to enforce.

v0.3 dynamic mutation (--dynamic): when a target refuses but still engages with an attack (a half-block), an LLM writes a variant with the same intent and Adversary retries, up to --dynamic-max-retries (default 2). This tests whether a safeguard generalizes or only caught the original wording. The corpus stays fixed. Every attempt is recorded in Finding.attempts[], and existing scorecard consumers keep working. In the first live run on Claude Haiku 5.5, 2 of 5 attacks landed only through a variant, for $0.003 total. If the API fails on every call, Adversary now exits with the error instead of reporting a clean score.

npx @weave_protocol/adversary demo               # mock, ~50ms
npx @weave_protocol/adversary demo --real        # real LLM (Haiku 5.5)
npx @weave_protocol/adversary demo --real --dynamic   # + LLM variants on half-blocks
npx @weave_protocol/adversary attack --url=...   # real browser agent
npx @weave_protocol/adversary demo --real --redact-evidence   # shareable scorecard

Locked scorecard schema v1.0 — consumed unchanged by AgentSecBench.

📄 Skill: adversarial-testing

🎯 AgentSecBench — The Benchmark

The interpretation layer on top of Adversary. Locked, versioned attack suites that produce tier-graded reports. ASB-Browser-v1 (v1.0) is 40 curated attacks: all 33 IPI + 4 critical tool-coercion + 3 highest-impact extraction.

npx @weave_protocol/agentsecbench run                          # default suite, tier-graded report
npx @weave_protocol/agentsecbench run --measure-ward-delta     # quantify policy effectiveness
npx @weave_protocol/agentsecbench compare baseline.json new.json

Tier grades A–F, four trophy attacks (Atlan, EchoLeak, Brave/Comet, Forcepoint), category gap analysis, optional WARD delta, plain-English interpretation prose. Reports are paste-ready Markdown — for blog posts, RFP responses, vendor audits, internal reviews.

📄 Skill: security-benchmarking · 📋 Methodology: METHODOLOGY.md →

🔌 API + Operator Dashboard

npx @weave_protocol/api
# → http://localhost:3000/dashboard

Live monitoring across all five enforcement surfaces in one view. The dashboard renders WARD.md at the top of a hierarchy diagram, fanning out to your configured enforcers (Hundredmen + the three vendor adapters + browser). Surfaces you're not using appear dimmed, so it's instantly clear what's protecting your agent versus what's available.

Includes a live activity feed (allows / denies / IPI detections / approvals), a WARD policy panel, and 24-hour aggregate stats. Auto-refreshes every 5 seconds. Monochrome design — built for ops rooms, not marketing decks.

📄 Skill: weave-api-calling

🔗 Langchain — The Bridge

Security integration for LangChain.js applications. Drop-in callbacks, secured tool wrappers, RAG retriever scanning with PII redaction.

📄 Skill: langchain-security

🏗️ Architecture

flowchart TD
    CLI["🕸️ <b>weave init / audit</b><br/><i>front door — @weave_protocol/cli</i>"]
    WARD["🛡️ <b>WARD.md</b><br/><i>policy standard — declares what the agent can't do</i>"]
    CLI --> WARD

    WARD -.->|enforced at runtime by| HM
    WARD -.->|enforced at runtime by| CC
    WARD -.->|enforced at runtime by| AG
    WARD -.->|enforced at runtime by| MSAF
    WARD -.->|enforced at runtime by| BR

    HM["🔍 <b>Hundredmen</b><br/>MCP layer<br/><i>open standard</i>"]
    CC["🛡️ <b>adapter-claudecode</b><br/>Anthropic<br/>✅ Live"]
    AG["🛡️ <b>adapter-antigravity</b><br/>Google · desktop + agy + SDK<br/>✅ Live"]
    MSAF["🛡️ <b>adapter-msaf</b><br/>Microsoft · middleware<br/>✅ Live"]
    BR["🌐 <b>browser</b><br/>Browser agents<br/>✅ Live"]

    HM --> AGENT
    CC --> AGENT
    AG --> AGENT
    MSAF --> AGENT
    BR --> AGENT

    subgraph AGENT["🤖 AI Agent System"]
        direction TB
        subgraph CORE["Defense — Core security"]
            direction LR
            MUND["🛡️ Mund<br/>Guardian<br/><i>scanning</i>"]
            HORD["🏛️ Hord<br/>Vault<br/><i>encryption</i>"]
            DOMERE["⚖️ Domere<br/>Judge<br/><i>compliance</i>"]
            WITAN["👥 Witan<br/>Council<br/><i>consensus</i>"]
        end
        subgraph OPS["Operations"]
            direction LR
            TOLLERE["🛂 Tollere<br/>Customs<br/><i>supply chain</i>"]
            API["🔌 API + Dashboard<br/><i>REST + UI</i>"]
            LC["🔗 LangChain bridge"]
        end
        CORE --> OPS
    end

    subgraph OFFENSIVE["⚔️ Offensive — we attack what we defend"]
        direction LR
        MUT["🧬 <b>Dynamic mutation</b><br/>LLM variants on half-blocks<br/><i>v0.3</i>"]
        ADV["⚔️ <b>Adversary</b><br/>68 attacks · 5 categories<br/><i>offensive engine</i>"]
        MUT -.->|retries with variant| ADV
        ASB["🎯 <b>AgentSecBench</b><br/>locked suites · tier A–F<br/><i>citable benchmark</i>"]
        ADV --> ASB
    end

    subgraph EXTERNAL["🌍 External integrations"]
        direction LR
        OSV["📚 OSV.dev<br/><i>dependency CVEs</i>"]
        GHCS["📋 GitHub code scanning<br/><i>SARIF alerts</i>"]
    end

    OSV -.->|advisories, cached offline| MUND
    MUND -.->|SARIF 2.1.0| GHCS

    AGENT -.->|attacked by| OFFENSIVE
    OFFENSIVE -.->|scorecards inform| WARD

    classDef policy fill:#1f2937,stroke:#60a5fa,stroke-width:2px,color:#fff
    classDef enforcer fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#fff
    classDef core fill:#312e81,stroke:#818cf8,stroke-width:1px,color:#fff
    classDef ops fill:#1e3a8a,stroke:#60a5fa,stroke-width:1px,color:#fff
    classDef offensive fill:#7f1d1d,stroke:#ef4444,stroke-width:2px,color:#fff
    classDef external fill:#374151,stroke:#9ca3af,stroke-width:1px,color:#fff

    class CLI,WARD policy
    class HM,CC,AG,MSAF,BR enforcer
    class MUND,HORD,DOMERE,WITAN core
    class TOLLERE,API,LC ops
    class ADV,ASB,MUT offensive
    class OSV,GHCS external

The diagram shows the loop. Defense surfaces enforce the policy at runtime. The offensive engine attacks the agent. Scorecards feed back into WARD as new evidence — what attacks land, which need new policy domains, what regressed since the last release. The loop is what makes the moat.

🔐 Security Model

Defense-in-depth across the entire AI agent lifecycle, validated continuously by an offensive engine that lives in the same monorepo:

1. 🛡️ Ward declares what the agent can and can't do (policy-as-code)
2. 🛡️ Harness adapters enforce WARD inside the IDE / CLI / framework:
   • adapter-claudecode for Claude Code (PreToolUse hooks)
   • adapter-antigravity for Google Antigravity (PreToolUse hooks across desktop/CLI/SDK)
   • adapter-msaf for Microsoft Agent Framework (middleware pipeline)
   • browser for browser-driving agents (runtime IPI scanning)
3. 🛂 Tollere inspects every dependency, image, and extension before it enters your project
4. 🛡️ Mund scans all inputs for threats before processing
5. 🏛️ Hord encrypts sensitive data at rest and in transit
6. ⚖️ Domere logs all actions with tamper-evident checksums and blockchain anchoring
7. 👥 Witan requires consensus for high-risk operations
8. 🔍 Hundredmen intercepts and gates tool calls in real-time — enforcing WARD policy at the MCP layer
9. 🔗 Langchain / Python secures LangChain.js and LlamaIndex chains and agents
10. ⚔️ Adversary attacks the entire stack with 68 documented and novel attacks
11. 🎯 AgentSecBench scores it, grades it A–F, and reports it in a standardized, citable format

CORS Model Integration

🛠️ Development

git clone https://github.com/Tyox-all/Weave_Protocol.git
cd Weave_Protocol

# Build each package
for pkg in mund hord domere witan hundredmen tollere langchain api cli ward \
           adapter-claudecode adapter-antigravity adapter-msaf browser \
           adversary agentsecbench; do
  (cd $pkg && npm install && npm run build)
done

🗺️ Roadmap

Shipped

• GDPR / CCPA / SOC2 / HIPAA / PCI-DSS / ISO27001 compliance frameworks
• MCP server reputation scoring
• Automated threat intelligence updates
• LangChain.js integration package
• Python/LlamaIndex integration
• Web dashboard for monitoring
• Supply chain security (Tollere) — npm, PyPI, Cargo, Go, Maven, Docker images, IDE extensions, sandwich pattern detection
• Bundle package + CLI (weave init)
• WARD.md agent security policy standard
• Hundredmen ↔ WARD enforcement integration (v1.1.0)
• Claude Code harness adapter (Anthropic)
• Google Antigravity harness adapter (Google)
• Microsoft Agent Framework harness adapter (Microsoft)
• Cross-platform thesis complete — same WARD.md works across all three major vendor harnesses + MCP

H2 2026 Q3 — Adoption Quarter

• Browser agent security (@weave_protocol/browser)
• Dashboard v2 with orchestration visualization
• State of AI Agent Security: Q3 Report — Industry analysis of agent security trends, platform maturity, supply chain risks, and market gaps

H2 2026 Q4 — Moat Quarter

• Adversarial agents (@weave_protocol/adversary v0.2.1) — 68 documented + novel attacks, real Playwright browser target, real-LLM demo mode
• Adversary v0.3 (@weave_protocol/adversary v0.3.0): LLM-driven dynamic mutation of half-blocked attacks, verified live on Claude Haiku 5.5; default model moved off the retired Claude 3.5 Haiku; API-failure runs now error out instead of scoring 100/100
• AgentSecBench (@weave_protocol/agentsecbench v0.1.0) — standardized benchmark, tier grades A–F
• Witan autonomous spending caps (@weave_protocol/witan v1.1.0) — per-window budgets on LLM cost + tokens + tool calls, gated by block / approval / notify
• Yoxallismus v2 (@weave_protocol/[email protected]) — open beta shipped. PQ-hybrid KEM (X25519 + ML-KEM-768 / NIST FIPS 203) + AEAD + ratcheting. Unaudited by design; validated by public use, forks, and responsible disclosure. v0.2+ adds DH double-ratchet, cascade cipher, threshold encryption; v0.3+ adds ZK/VDF/QRNG; v0.4+ adds FHE. See yoxallismus/README.md.
• Mund parity floor: SARIF output (mund-mcp scan --format=sarif), OSV.dev live CVE lookups with offline fallback, 0–100 risk score, CycloneDX SBOM + Sigstore attestations in publish-all, OWASP LLM + Agentic coverage tables

🤝 Contributing

Bug reports and feature requests welcome via GitHub Issues.

For security issues, please see SECURITY.md.

For all other inquiries: [email protected]

See CONTRIBUTING.md for guidelines.

📄 License

Apache 2.0 — See LICENSE

🔗 Links

• GitHub: https://github.com/Tyox-all/Weave_Protocol
• npm packages: https://www.npmjs.com/~tyox-all
• PyPI: https://pypi.org/project/weave-protocol-llamaindex/
• MCP Registry: https://registry.modelcontextprotocol.io (search "mund")
• Q3 2026 Report: https://tyox-all.github.io/Weave_Protocol/q3-2026.html
• Adversary on npm: https://www.npmjs.com/package/@weave_protocol/adversary
• AgentSecBench on npm: https://www.npmjs.com/package/@weave_protocol/agentsecbench

Built with ❤️ for the AI agent ecosystem. We attack what we defend.