registry / @remcp/runtime / 0.2.138
@remcp/runtime@0.2.138
First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The scanner signals are consistent with package-aligned local runtime capabilities and do not support a warning or block.
Static reason
One or more suspicious static signals were detected.
Trigger
Runtime use of its advertised tools; the manifest contains no install lifecycle hook.
Impact
No confirmed malicious impact or attack surface was established.
Mechanism
Inspected network behavior points to local browser control, while telemetry uses a restricted event schema.
AI rationale
Source inspection found no concrete attack behavior. The scanner signals are consistent with package-aligned local runtime capabilities and do not support a warning or block.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install lifecycle hook; its scripts are start, check, and test.
- The Linux desktop module dynamically imports the declared D-Bus dependency for desktop integration.
- Document reads use read-only, no-follow file flags.
- Telemetry restricts event fields to bounded, coarse values.
- Browser control defaults to a loopback DevTools endpoint.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedsrc/extended/desktop-linux.mjsView file
1368package = @remcp/runtime; repositoryIdentity = remcp; dependency = @jellybrick/dbus-next
L1368: let dbus;
L1369: try { dbus = await import('@jellybrick/dbus-next'); } catch { return null; }
L1370: const bus = dbus.sessionBus();
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
src/extended/desktop-linux.mjsView on unpkg · L13681369try { dbus = await import('@jellybrick/dbus-next'); } catch { return null; }
const bus = dbus.sessionBus();
try {
const ob
Low
Suspicious Dependency Evidence
The Linux desktop module dynamically imports the declared D-Bus dependency for desktop integration.
src/extended/desktop-linux.mjsView on unpkg · L1369src/helpers/wayland-eis-helper.pyView file
•
Findings
2 High4 Medium6 Low
HighCopied Package Dependency Bridgesrc/extended/desktop-linux.mjs
HighSemantic Analysis Limitedsrc/extended/documents.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpersrc/helpers/wayland-eis-helper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencesrc/extended/desktop-linux.mjs
Affected versions and remediation
This report applies to @remcp/runtime@0.2.138.
See all versions of @remcp/runtime for other recorded verdicts.
- Review the evidence and your use of @remcp/runtime@0.2.138 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.