Mund — MCP Security Scanner

Submit a new consumer request (Right to Know, Delete, Correct, etc.)

Verify integrity of CCPA checkpoint chain

Verify consumer identity for a request

Withdraw a consumer opt-out

Add hop to thread

Full semantic analysis

Check intent drift

Check for prompt injection

Close thread

Create thread from human intent

Detect language in content

Estimate blockchain cost

Track automated decisions and ensure Article 22 compliance. Records automated decision-making, tracks human review requirements, manages appeals. Use when: logging AI/ML decisions, ensuring human oversight, handling decision appeals.

Report and manage data breaches per GDPR Articles 33-34. Tracks 72-hour notification deadline and manages breach response workflow. Use when: reporting data breaches, tracking breach response, notifying authorities/subjects.

Check if a data subject has valid consent for a specific purpose. Returns current consent status and details. Use when: validating consent before processing, checking consent status, auditing consent records.

Export data subject's personal data in a portable format per GDPR Article 20. Generates a machine-readable export of all personal data. Use when: handling portability requests, exporting user data, transferring data to another controller.

Create and manage a Data Subject Access Request (DSAR). Supports all GDPR rights: access (Art 15), rectification (Art 16), erasure (Art 17), restriction (Art 18), portability (Art 20), objection (Art 21), automated decisions (Art 22). Use when: receiving subject rights requests, managing DSAR workflow, tracking request deadlines.

Create or update processing activity records per GDPR Article 30. Maintains the required register of processing activities. Use when: documenting new processing activities, updating existing records, audit preparation.

Record a data subject's consent for a specific processing purpose. Creates an auditable consent record with legal basis tracking per GDPR Article 6. Use when: capturing user consent, updating consent preferences, documenting legal basis for processing.

Generate GDPR compliance reports and dashboards. Creates audit-ready reports for consent, DSARs, breaches, retention, and overall compliance. Use when: preparing for audits, generating compliance dashboards, reviewing GDPR status.

Manage and execute data retention policies per GDPR Article 5(1)(e). Enforces storage limitation principle and documents retention decisions. Use when: creating retention policies, running retention checks, auditing data lifecycle.

Execute the right to erasure ("right to be forgotten") per GDPR Article 17. Permanently deletes all personal data for a subject while maintaining audit compliance. Use when: processing erasure requests, handling deletion requests, clearing user data.

Withdraw a previously granted consent. Creates an audit trail of the withdrawal per GDPR Article 7(3). Use when: user requests to withdraw consent, updating consent status, handling opt-out requests.

Get thread details

List threads

Prepare anchor transaction

Verify thread integrity

Create a cryptographic attestation for an action

Create a policy for redacting sensitive data

Create an isolated execution environment

Create a new encrypted vault for storing agent state, memories, and credentials

Delegate a capability to another agent

Destroy a sandbox and clean up resources

Reverse tokenization to get original values

Execute code or command in a sandbox

Export attestations for audit

Get the chain of attestations

Get attestations for an agent

Get results from a sandbox

List capability tokens for an agent

List all redaction policies

List all vaults accessible to an agent

Open a vault for reading and writing

Promote a sandbox result for real execution

Redact sensitive data from content

Request a capability token for accessing a resource

Retrieve memories from a vault

Retrieve a credential from a vault

Revoke a capability token

Close and re-encrypt a vault

Store a memory in a vault

Store an encrypted credential in a vault

Tokenize PII in text

Verify an attestation is valid

Verify if a capability token is valid for an action

Manually approve a pending call. Use when: allowing a blocked operation after review, unblocking legitimate actions.

Manually block a pending call. Use when: preventing suspicious actions, blocking after review.

Get reputation score and details for an MCP server. Shows trust score, security score, community reports, and verification status. Use when: evaluating server trustworthiness, before enabling new servers.

Dry-run a tool call against the loaded WARD.md policy without executing it. Returns the decision (allow / deny / require_approval) and the breakdown of which checks fired. Use when: testing a policy, debugging why a call was blocked, or pre-flighting a sensitive operation.

Create a new inspection session for tracking AI agent activity. Sessions group tool calls and enable drift detection across the conversation. Use when: starting a new task, beginning agent workflow, initializing inspection.

Declare the intended actions for a session. Enables drift detection by comparing actual tool calls against declared intent. Use when: before performing a task, setting expectations, documenting purpose.

Compare declared intent vs actual actions ("Said X, doing Y" analysis). Identifies drift between what the AI said it would do and what it's actually doing. Use when: verifying agent behavior, catching unauthorized actions, security review.

End an inspection session and get summary statistics. Use when: task completed, workflow finished, cleaning up.

Query historical call data with filters. Use when: auditing past activity, investigating incidents, generating reports.

Get current inspector configuration. Use when: reviewing settings, debugging policy issues.

Get recent intercepted calls in real-time. Shows what the AI agent is actually doing vs what it said it would do. Use when: monitoring agent activity, reviewing actions, debugging behavior.

Get all calls waiting for manual approval. Use when: reviewing risky operations, approving/blocking queued actions.

Get detailed statistics for an MCP server. Shows call patterns, error rates, response times, and anomalies. Use when: analyzing server behavior, investigating issues, capacity planning.

Get overall inspector statistics. Shows total calls, approval rate, block rate, active sessions. Use when: monitoring system health, generating reports.

List all known servers with reputation scores. Use when: reviewing server inventory, finding low-reputation servers.

Load a WARD.md security policy. If no path is given, attempts to load from \$WEAVE_WARD_PATH or ./WARD.md. Use when: starting a new task with explicit policy enforcement, or testing a new policy before deployment.

Report suspicious behavior from an MCP server. Contributes to community reputation scoring. Use when: server behaves unexpectedly, potential security issue, data concerns.

Configure inspection policies. Set which operations require approval, risk thresholds, etc. Use when: customizing security rules, adjusting sensitivity.

Show the currently loaded WARD.md policy and its source. Use when: confirming which policy is active, debugging unexpected blocks.

Remove the active WARD.md policy. Subsequent tool calls will not be gated by WARD. Use when: switching policies, or temporarily disabling enforcement.

Mark a security event/alert as acknowledged. Args: - event_id (string): ID of the event to acknowledge - acknowledged_by (string): Optional name/ID of acknowledger Returns: Confirmation of acknowledgment

Add a custom threat intelligence feed. Supports URL, file, and API sources.

Add a custom security detection rule. Create custom rules to detect specific patterns in content. Rules use regular expressions for pattern matching and can be configured with different severity levels and actions. Args: - id (string): Unique rule identifier (lowercase, alphanumeric, underscores) - name (string): Human-readable rule name - description (string): Optional description - type: Detection type (secret, pii, code_pattern, injection, exfiltration) - pattern (string): Regular expression to match - severity: Severity level (critical, high, medium, low, info) - action: Ac…

Add a pattern to the allowlist. Allowlisted patterns will be ignored by detection rules. Args: - pattern (string): Pattern to allowlist - type: Type of pattern Returns: Confirmation of allowlist addition

Analyze the permission scope and capabilities of an MCP server's tools. Identifies network access, filesystem operations, command execution, and other potentially dangerous capabilities.

Add a pattern to the blocklist. Blocked patterns will always be flagged regardless of other rules. Args: - pattern (string): Pattern to block - type: Type of pattern (secret, pii, code_pattern, injection, exfiltration) Returns: Confirmation of blocklist addition

Detect MCP rug pulls: compare a server manifest with the baseline recorded when the server was first checked. Flags changed tool descriptions or schemas, and added or removed tools; escalates to critical when a changed tool now looks malicious or gains command execution. The first check records the baseline.

Check if an MCP server name is potentially typosquatting a known legitimate server. Compares against a list of official and common MCP servers.

Check if a URL is safe to access. Validates URLs against known dangerous patterns including: - Data exfiltration services (webhook.site, requestbin, etc.) - IP-based URLs (often used to bypass domain filtering) - Suspicious TLDs (.tk, .ml, etc.) - Data URLs (can contain arbitrary content) Args: - url (string): The URL to check (required) - tool_name (string): Name of tool attempting access (optional) - agent_id (string): ID of requesting agent (optional) Returns: JSON object with: - url: The checked URL - safe: Boolean indicating if URL is safe - risk_level: 'safe' | 'suspicio…

Configure a notification channel for security alerts. Note: Full configuration requires environment variables. This tool can update webhook URLs and minimum severity settings at runtime. Args: - type: Channel type (slack, teams, email, webhook) - webhook_url: Webhook URL (for slack, teams, webhook) - min_severity: Minimum severity to notify Returns: Confirmation of configuration

Create a canary token to place in a system prompt or other confidential context. Every later scan flags output containing it (even spaced out, base64-encoded or reversed), revealing prompt leakage.

Retrieve recent security events from the Mund monitoring system. Supports filtering and pagination for efficient event retrieval. Args: - limit (number): Maximum events to return, 1-1000 (default: 50) - offset (number): Skip this many events for pagination (default: 0) - severity ('critical' | 'high' | 'medium' | 'low' | 'info'): Filter by severity - type: Filter by detection type - acknowledged (boolean): Filter by acknowledgment status Returns: JSON object with: - total: Total matching events - count: Events in this response - offset: Current offset - has_more: Whether…

Get the current status of the Mund monitoring system. Returns information about: - Active analyzers and their status - Number of rules loaded - Configured notification channels - Block mode status - Recent event statistics

Get threat intelligence health status including source coverage, pattern counts by category, and MITRE ATT&CK technique coverage.

List registered canary tokens.

List all configured threat intelligence sources with their status, update intervals, and pattern counts.

Browse threat detection patterns by source, category, or enabled status.

List all configured detection rules. Args: - type: Optional filter by detection type - enabled_only: Only show enabled rules (default: false) Returns: Array of rule configurations

Remove a canary token.

Remove a custom threat intelligence source and all its patterns.

Remove a custom detection rule by ID. Note: Built-in rules cannot be removed, only disabled. Args: - id (string): ID of the rule to remove Returns: Confirmation of rule removal

Scan text or code content for security vulnerabilities, secrets, PII, and other issues. This tool analyzes the provided content using multiple security analyzers: - Secret Scanner: Detects API keys, tokens, passwords, and credentials - PII Detector: Finds personal identifiable information - Code Analyzer: Identifies dangerous code patterns - Injection Detector: Spots prompt injection attempts - Exfiltration Detector: Detects data exfiltration patterns Args: - content (string): The text/code to scan (required) - content_type ('text' | 'code' | 'json' | 'yaml'): Type of content (default: '…

Scan an MCP server manifest (server.json) for security issues before installation. Detects prompt injection in tool descriptions, typosquatting, embedded secrets, and dangerous permissions.

Scan content using threat intelligence patterns. Returns findings with MITRE ATT&CK technique mappings.

Enable or disable a specific threat detection pattern.

Pull latest threat patterns from configured intelligence feeds. Updates MITRE ATT&CK mappings and community blocklists.

Validate a shell command for safety before execution. Checks for dangerous patterns including: - Destructive commands (rm -rf, format, etc.) - Privilege escalation (sudo, chmod 777, etc.) - Network exfiltration (curl to suspicious URLs, etc.) - Code injection (eval, exec with variables, etc.) Args: - command (string): Shell command to validate (required) - tool_name (string): Name of tool executing command (optional) - agent_id (string): ID of requesting agent (optional) Returns: JSON object with: - command: The validated command - safe: Boolean indicating if command is safe -…

Query OSV.dev for known vulnerabilities affecting a specific package version.

Get maintainer reputation score for a package (0-100, higher = more trustworthy).

Check if a package name is suspiciously similar to a popular package.

Detect sandwich-pattern attacks across the version history of a package - where malicious code is removed in a clean version then reappears later. The Checkmarx case detector.

Compare two versions of a package to detect suspicious changes (new install scripts, injected dependencies, obfuscated code). The Axios case detector.

Scan an entire package.json for supply chain risks. Returns a full report.

Scan a Docker image for supply chain risks - tag overwriting, phantom tags, suspicious manifest patterns. Use BEFORE `docker pull`.

Scan an IDE extension for supply chain risks. Covers VS Code (and Cursor/Windsurf), Open VSX (VSCodium/Gitpod), and JetBrains IDEs (IntelliJ/PyCharm/WebStorm/etc).

Scan a single package for supply chain risks (typosquats, CVEs, low reputation, suspicious patterns). Use BEFORE `npm install <name>`.

Check if an interpretation has drifted from the original intent

Check content for prompt injection and jailbreak attempts

Check URL safety

Create compliance checkpoint

Create a new thread to track agent actions

Redact sensitive information (PII, secrets) from content

Redact PII from text

Execute code in a secure sandbox

Scan content for security threats including secrets, PII, injection attempts, and exfiltration patterns

Scan content specifically for secrets and credentials

Store secret in vault