@remcp/runtime
First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.
This report shows the evidence for @remcp/runtime@0.2.230. 0 of 123 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 10h ago · by lpm-firewall-aiThe inspected source supports the advertised local device runtime functions. Runtime telemetry is disclosed, constrained to usage fields, routed through the paired agent, and can be disabled; screenshot capture is request-triggered.
Decision evidence
public snapshot- The package is a first-party local device runtime exposing filesystem, terminal, computer-use, browser, diagnostics, and document tools.
- Runtime metrics are disclosed as anonymous, limited to tool names, timings, and outcomes, and sent through the user's paired ReMCP agent.
- Telemetry fields are whitelisted to exclude file paths, commands, tool arguments, and tool output.
- Screenshot capture runs only when its tool is invoked and saves captures to a requested or temporary directory.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
src/screenshot-portal.mjsView on unpkg · L259Package ships non-JavaScript build or shell helper files.
src/helpers/wayland_eis_sender.pyView on unpkgFindings
Affected versions and remediation
This report applies to @remcp/runtime@0.2.230.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @remcp/runtime@0.2.230 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.