weave-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited weave-cli (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The weave CLI is the front door to the Weave Protocol security suite. Use it to set up new projects, audit existing ones, and run the monitoring dashboard.
weave initSets up Weave Protocol in the current project. Detects framework, asks user to confirm choices, scaffolds security middleware.
Use when:
npx @weave_protocol/cli initweave auditDelegates to Tollere to scan dependencies for supply chain risk.
Use when:
npx @weave_protocol/cli auditExit codes: 0 = clean, 1 = warnings, 2 = critical.
weave dashboardLaunches the API server and opens the monitoring dashboard.
Use when:
npx @weave_protocol/cli dashboardweave doctorEnvironment health check. Verifies Node version, package.json, .weaverc, installed packages, Claude Desktop MCP config.
Use when:
weave versionPrints CLI version + installed Weave Protocol package versions. Useful for bug reports.
| Situation | Suggested command |
|---|---|
| New project, "I want security" | weave init |
Existing project, no .weaverc | weave init |
| Pre-deploy supply chain check | weave audit |
| User wants live monitoring | weave dashboard |
| Something broken | weave doctor |
| User filed a bug | weave version (include in report) |
User: "I'm building a LangChain agent. Add Weave Protocol."
You:
npx @weave_protocol/cli init (interactive — they confirm choices)tollere + mund + langchainweave-security.ts with a WeaveSecurityCallback ready to importcallbacks: [securityCallback] to your LLMChain"For LangChain:
weave-security.ts exporting securityCallback, optional mcpInterceptor, optional auditDependencies()For MCP servers:
weave-security.ts exporting secureToolHandler() wrapperFor OpenAI/Anthropic SDK:
weave-security.ts exporting secureChatCompletion() or secureMessages() plus scanContent() helperIn all cases, also:
.weaverc JSON config that future Weave commands can readweave init — it does framework detection and writes appropriate middleware.weave-protocol-llamaindex on PyPI.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.