registry / @ethanwilkins/mcp-chrome-bridge-2026 / 1.2.1

@ethanwilkins/mcp-chrome-bridge-2026@1.2.1

Chrome Native-Messaging host (Node)

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface. Native-host registration is an explicit CLI capability for the package's browser bridge and is scoped to one extension ID.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit `mcp-chrome-bridge register` command or normal local MCP/browser-bridge runtime.

Impact

The user-invoked registration can permit the named Chrome extension to start this package's local native host; no unconsented lifecycle mutation occurs.

Mechanism

Scoped Chrome/Chromium native-messaging host registration and localhost MCP bridge.

Rationale

The scanner's lifecycle finding is a false positive: the postinstall command imports a module whose side effects are protected by a direct-execution guard. The remaining sensitive behavior is package-aligned, explicitly invoked browser native-host registration with no confirmed exfiltration or stealth persistence.

Evidence

package.jsondist/scripts/postinstall.jsdist/scripts/utils.jsdist/scripts/browser-config.jsdist/scripts/constant.jsdist/constant/index.jsdist/run_host.sh

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

@ethanwilkins/mcp-chrome-bridge-2026@1.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code