@lensmcp/client-runtime@1.25.22
⚠ Under reviewLensMCP browser-side capture layer — errors, console, fetch, and route changes streamed to the LensMCP bridge. Import '@lensmcp/client-runtime/auto' for a zero-build install in any host.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected code shows browser capture and replay delivery to a configurable LensMCP bridge, with replay requests omitting credentials. However, the selected @lensmcp/core dependency source was unavailable, preventing assessment of the imported redaction helper; manual review is warranted.
Decision evidence
public snapshot- The package depends on @lensmcp/core@1.25.22, whose source could not be inspected in this snapshot.
- The runtime imports redactUrl from that dependency while sanitizing replay anchors, so its behavior is relevant to the review.
- The inspected runtime connects to a configurable LensMCP bridge and sends replay requests with credentials omitted.
- No concrete attack behavior was identified in the inspected source.
Source & flagged code
7 flaggedThe package depends on @lensmcp/core@1.25.22, whose source could not be inspected in this snapshot.
package.jsonView on unpkg · L37The runtime imports redactUrl from that dependency while sanitizing replay anchors, so its behavior is relevant to the review.
lib/replay/anchors.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @lensmcp/client-runtime@1.25.22.
See all versions of @lensmcp/client-runtime for other recorded verdicts.
- Review the evidence and your use of @lensmcp/client-runtime@1.25.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.