Skip to main content
Glama

πŸ•ΈοΈ Weave Protocol

Enterprise Security Suite for AI Agents

npm npm npm npm npm npm npm npm npm npm npm npm npm npm License

A TypeScript monorepo providing security, encryption, compliance, and governance tools for AI agent systems. Built for the Model Context Protocol (MCP) ecosystem.


πŸ†• What's New

LangChain.js Integration (v1.0.1)

Drop-in security for LangChain.js applications:

import { WeaveSecurityCallback } from '@weave_protocol/langchain';

const chain = new LLMChain({
  llm: new ChatOpenAI(),
  prompt,
  callbacks: [new WeaveSecurityCallback({ action: 'block' })],
});

// Threats in input/output automatically blocked
await chain.invoke({ question: 'Ignore previous instructions...' });
// Error: [WeaveSecurityCallback] Blocked: Threat detected

Features: Callback handler, secure tool wrappers, RAG document scanning, PII redaction

See LangChain README β†’

Automated Threat Intelligence (Mund v0.2.2)

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚  mund_intel_status                                            β”‚
β”‚                                                               β”‚
β”‚  Sources: 3 enabled (2 auto-updating)                         β”‚
β”‚  Patterns: 47 total across 7 categories                       β”‚
β”‚  MITRE: 10 techniques, 6 tactics covered                      β”‚
β”‚                                                               β”‚
β”‚  βœ… weave_builtin    20 patterns (core)                       β”‚
β”‚  βœ… weave_community  15 patterns (auto-update: 24h)           β”‚
β”‚  βœ… mitre_llm        12 patterns (auto-update: 7d)            β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

New threat intel tools: mund_update_threat_intel, mund_intel_status, mund_threat_scan, mund_list_intel_sources

See Mund README β†’


πŸ“¦ Packages

Package

Version

Description

πŸ›‘οΈ @weave_protocol/mund

0.2.2

Security scanner - secrets, PII, injection, MCP vetting, threat intel

πŸ›οΈ @weave_protocol/hord

0.1.6

Encrypted vault with Yoxallismus cipher

βš–οΈ @weave_protocol/domere

1.3.3

Compliance (PCI-DSS, ISO27001, SOC2, HIPAA, GDPR) & verification

πŸ‘₯ @weave_protocol/witan

1.0.2

Multi-agent consensus & governance

πŸ” @weave_protocol/hundredmen

1.0.6

Real-time MCP proxy - intercept, scan, gate tool calls

πŸ”— @weave_protocol/langchain

1.0.1

LangChain.js security callbacks & tool wrappers

πŸ”Œ @weave_protocol/api

1.0.11

REST API for all packages


πŸ€– AI Agent Skills

Each package includes a SKILL.md file following the Claude Agent Skills specification. These teach AI agents how to use Weave Protocol tools effectively.

Package

Skill Name

Triggers

πŸ›‘οΈ Mund

security-scanning

scan, detect secrets, check injection, vet MCP server, threat intel

πŸ›οΈ Hord

encrypting-data

encrypt, decrypt, vault, Yoxallismus, protect

βš–οΈ Domere

compliance-auditing

audit, checkpoint, SOC2, HIPAA, PCI-DSS, GDPR, blockchain

πŸ‘₯ Witan

consensus-governance

consensus, vote, approve, policy, escalate

πŸ” Hundredmen

security-inspection

intercept, drift, reputation, approve, block, live feed

πŸ”— Langchain

langchain-security

LangChain, callback, secure tool, RAG security, PII redaction

πŸ”Œ API

weave-api-calling

REST API, HTTP endpoint, curl, fetch

Installation:

Copy skill files to your Claude skills directory:

# Clone repo
git clone https://github.com/Tyox-all/Weave_Protocol.git

# Copy skills to Claude Code
mkdir -p ~/.claude/skills/weave-protocol
cp Weave_Protocol/*/SKILL.md ~/.claude/skills/weave-protocol/

# Or for Claude.ai (upload as custom skills)
# Settings > Features > Custom Skills > Upload ZIP

Once installed, Claude automatically invokes the appropriate skill when you ask it to scan content, encrypt data, create compliance checkpoints, or coordinate multi-agent consensus.


πŸš€ Quick Start

Install All Packages

npm install @weave_protocol/mund @weave_protocol/hord @weave_protocol/domere @weave_protocol/hundredmen @weave_protocol/langchain

Claude Desktop Integration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mund": {
      "command": "npx",
      "args": ["-y", "@weave_protocol/mund"]
    },
    "hord": {
      "command": "npx",
      "args": ["-y", "@weave_protocol/hord"]
    },
    "domere": {
      "command": "npx",
      "args": ["-y", "@weave_protocol/domere"]
    },
    "hundredmen": {
      "command": "npx",
      "args": ["-y", "@weave_protocol/hundredmen"]
    }
  }
}

MCP Registry

Mund is available on the official MCP Registry:

# Search for it
https://registry.modelcontextprotocol.io
# Server ID: io.github.Tyox-all/mund

✨ Package Details

πŸ›‘οΈ Mund - The Guardian

Real-time security scanning for AI agents.

Category

Features

Secrets

API keys, tokens, passwords, certificates (30+ patterns)

PII

SSN, credit cards, emails, phone numbers, addresses

Injection

Prompt injection, jailbreak attempts, instruction override

Exfiltration

Data leakage, encoding tricks, steganography

Code

Dangerous patterns, eval/exec, SQL injection, XSS

MCP Servers

Malicious tool descriptions, typosquatting, dangerous permissions

Threat Intel

MITRE ATT&CK patterns, community feeds, auto-updates

// Scan content
const result = await mund.scan("Here's my key: sk-abc123...");
// { safe: false, issues: [{ severity: "critical", ... }] }

// Scan MCP server before install
const serverScan = await mund.scanMcpServer(serverJson);
// { recommendation: "DO_NOT_INSTALL", issues: [...] }

// Check threat intel status
const status = await mund.intelStatus();
// { patterns: 47, mitre_techniques: 10, sources: 3 }

πŸ“„ Skill: security-scanning


πŸ›οΈ Hord - The Vault

Encrypted storage with the Yoxallismus dual-tumbler cipher.

Category

Features

Encryption

AES-256-GCM, ChaCha20-Poly1305

Key Derivation

Argon2id with configurable parameters

Yoxallismus

Dual-layer tumbler/deadbolt obfuscation

Memory Safety

Secure buffer handling, auto-zeroing

MCP Server

Claude Desktop integration, vault management tools

import { YoxallismusCipher } from '@weave_protocol/hord';

const cipher = new YoxallismusCipher('master-key');

// Lock (encrypt + obfuscate)
const locked = await cipher.lock(sensitiveData);

// Unlock (de-obfuscate + decrypt)
const unlocked = await cipher.unlock(locked);

Yoxallismus Cipher: A dual-layer encryption combining AES-256-GCM with tumbler/deadbolt obfuscation. Data is first encrypted, then the ciphertext is scrambled using position-dependent transformations that require both the key and the original encryption context to reverse.

πŸ“„ Skill: encrypting-data


βš–οΈ Domere - The Judge

Enterprise-grade verification, orchestration, compliance, and audit infrastructure.

Category

Features

Verification

Intent tracking, drift detection, execution replay, multi-agent handoff

Orchestration

Task scheduler, agent registry, shared state with locks

Compliance

SOC2, HIPAA, PCI-DSS, ISO27001, GDPR checkpoints & reporting

Blockchain

Solana & Ethereum anchoring for immutable audit trails

Blockchain Anchoring:

  • Solana Mainnet: 6g7raTAHU2h331VKtfVtkS5pmuvR8vMYwjGsZF1CUj2o

  • Solana Devnet: BeCYVJYfbUu3k2TPGmh9VoGWeJwzm2hg2NdtnvbdBNCj

  • Ethereum: 0xAA8b52adD3CEce6269d14C6335a79df451543820

import { ComplianceManager } from '@weave_protocol/domere';

const compliance = new ComplianceManager(['pci-dss', 'iso27001', 'soc2', 'hipaa']);

// Create tamper-evident checkpoint
const checkpoint = await compliance.createCheckpoint({
  action: 'data_access',
  resource: 'customer_records',
  actor: 'agent-001'
});

// Generate audit report
const report = await compliance.generateReport('pci-dss', {
  startDate: '2024-01-01',
  endDate: '2024-12-31'
});

πŸ“„ Skill: compliance-auditing


πŸ‘₯ Witan - The Council

Multi-agent consensus and governance.

Category

Features

Consensus

Unanimous, majority, weighted, quorum protocols

Policy

Rule enforcement, permission management, escalation

Communication

Agent bus, broadcast, point-to-point messaging

Recovery

Failure detection, automatic failover, state recovery

import { ConsensusEngine, PolicyEngine } from '@weave_protocol/witan';

const consensus = new ConsensusEngine({
  protocol: 'weighted_majority',
  threshold: 0.66,
  timeout: 30000
});

// Propose action requiring consensus
const result = await consensus.propose({
  action: 'deploy_to_production',
  requiredApprovals: ['security-agent', 'qa-agent', 'ops-agent']
});

πŸ“„ Skill: consensus-governance


πŸ” Hundredmen - The Watchers

Real-time MCP security proxy that intercepts, scans, and gates AI agent tool calls.

Category

Features

Interception

Proxy all MCP tool calls in real-time

Drift Detection

"Said X, doing Y" analysis - catch unauthorized actions

Reputation

Server trust scores, community reports, malicious detection

Manual Gates

Require approval for high-risk operations

Live Feed

Real-time stream of agent activity

import { Interceptor, ReputationManager } from '@weave_protocol/hundredmen';

const interceptor = new Interceptor({
  mode: 'active',           // 'passive' | 'active' | 'strict'
  driftDetectionEnabled: true,
  reputationEnabled: true,
  minReputationScore: 30,
});

// Create session and declare intent
const session = interceptor.createSession('my-agent');
interceptor.declareIntent(session.id, 'Read and summarize the README file');

// Intercept a tool call
const call = await interceptor.intercept(
  session.id,
  'filesystem',
  'read_file',
  { path: '/README.md' }
);

// Check decision
if (call.status === 'approved') {
  // Execute the actual call
} else if (call.status === 'pending') {
  console.log('Manual approval required:', call.decisionReason);
} else {
  console.log('Blocked:', call.decisionReason);
}

πŸ“„ Skill: security-inspection


πŸ”— Langchain - The Bridge

Security integration for LangChain.js applications.

Category

Features

Callbacks

Drop-in WeaveSecurityCallback for any chain/agent

Tool Wrappers

Wrap tools with threat scanning and approval gates

Retrievers

Scan RAG documents, auto-redact PII

Presets

Strict, warning, and production configurations

import { WeaveSecurityCallback, createSecureRetriever } from '@weave_protocol/langchain';

// Callback for any LangChain component
const callback = new WeaveSecurityCallback({
  action: 'block',        // block | warn | log
  minSeverity: 'medium',
  scanTools: true,
  scanRetrievers: true,
});

// Secure RAG retriever with PII redaction
const secureRetriever = createSecureRetriever(vectorStore.asRetriever(), {
  name: 'company-docs',
  scanDocuments: true,
  redactSensitive: true,
});

πŸ“„ Skill: langchain-security


πŸ—οΈ Architecture

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚                       AI Agent System                         β”‚
β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€
β”‚                                                               β”‚
β”‚  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”      β”‚
β”‚  β”‚  πŸ›‘οΈ Mund β”‚  β”‚ πŸ›οΈ Hord  β”‚  β”‚ βš–οΈ Domereβ”‚  β”‚ πŸ‘₯ Witan β”‚      β”‚
β”‚  β”‚ Guardian β”‚  β”‚  Vault   β”‚  β”‚  Judge   β”‚  β”‚ Council  β”‚      β”‚
β”‚  β””β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”˜      β”‚
β”‚       β”‚             β”‚             β”‚             β”‚             β”‚
β”‚  Security      Encryption    Compliance     Consensus        β”‚
β”‚  Scanning      Storage       Verification   Governance       β”‚
β”‚       β”‚             β”‚             β”‚             β”‚             β”‚
β”‚       β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜             β”‚
β”‚                           β”‚                                   β”‚
β”‚  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”   β”Œβ”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”   β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”          β”‚
β”‚  β”‚πŸ” Hundredmen β”‚   β”‚  πŸ”Œ API   β”‚   β”‚ πŸ”— Langchain β”‚          β”‚
β”‚  β”‚  Watchers    β”‚   β”‚   REST    β”‚   β”‚   Bridge     β”‚          β”‚
β”‚  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜   β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜   β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜          β”‚
β”‚                                                               β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

πŸ”Œ REST API

The @weave_protocol/api package provides HTTP endpoints for all functionality:

# Start the API server
npx @weave_protocol/api

# Or with Docker
docker run -p 3000:3000 weave-protocol/api

Endpoints:

Method

Path

Description

POST

/mund/scan

Scan content for security issues

POST

/mund/scan-mcp-server

Scan MCP server manifest

POST

/hord/encrypt

Encrypt data

POST

/hord/decrypt

Decrypt data

POST

/hord/yoxallismus/lock

Lock with Yoxallismus cipher

POST

/hord/yoxallismus/unlock

Unlock with Yoxallismus cipher

POST

/domere/checkpoint

Create compliance checkpoint

GET

/domere/compliance/frameworks

List available frameworks

POST

/domere/compliance/report

Generate compliance report

πŸ“„ Skill: weave-api-calling


πŸ” Security Model

Weave Protocol implements defense-in-depth:

  1. πŸ›‘οΈ Mund scans all inputs for threats before processing

  2. πŸ›οΈ Hord encrypts sensitive data at rest and in transit

  3. βš–οΈ Domere logs all actions with tamper-evident checksums

  4. πŸ‘₯ Witan requires consensus for high-risk operations

  5. πŸ” Hundredmen intercepts and gates tool calls in real-time

  6. πŸ”— Langchain secures LangChain.js chains and agents

CORS Model Integration

The Weave Protocol maps to the CORS Model for AI agent security:

CORS Layer

Weave Package

Function

Origin Validation

πŸ›‘οΈ Mund

Validates input sources, detects injection

Context Integrity

πŸ›οΈ Hord

Protects data integrity through encryption

Deterministic Enforcement

βš–οΈ Domere

Ensures consistent policy application

Runtime Interception

πŸ” Hundredmen

Gates tool calls, detects drift


πŸ› οΈ Development

# Clone
git clone https://github.com/Tyox-all/Weave_Protocol.git
cd Weave_Protocol

# Install dependencies (each package)
cd mund && npm install && npm run build
cd ../hord && npm install && npm run build
cd ../domere && npm install && npm run build
cd ../hundredmen && npm install && npm run build
cd ../langchain && npm install && npm run build

# Run tests
npm test

πŸ—ΊοΈ Roadmap

  • GDPR compliance framework

  • MCP server reputation scoring

  • Automated threat intelligence updates

  • LangChain.js integration package

  • Python/LlamaIndex integration

  • Web dashboard for monitoring

  • CCPA compliance framework


🀝 Contributing

See CONTRIBUTING.md for guidelines.


πŸ“„ License

Apache 2.0 - See LICENSE



Built with ❀️ for the AI agent ecosystem.

-
security - not tested
A
license - permissive license
-
quality - not tested

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Tyox-all/Weave_Protocol'

If you have feedback or need assistance with the MCP directory API, please join our Discord server