@remcp/runtime@0.2.211
First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged dependency bridge serves on-demand Wayland screenshot capture. Runtime telemetry is disclosed, can be disabled, is limited to operational metrics, and travels through the user's paired ReMCP agent; no malicious behavior was found.
Decision evidence
public snapshot- Package metadata describes a first-party ReMCP local device runtime and declares no lifecycle scripts.
- The CLI discloses opt-out usage metrics, describes the collected fields, and says they go through the user's paired ReMCP agent.
- Telemetry is sent as an MCP notification through the runtime server, not to a hard-coded external endpoint.
- Telemetry fields are whitelisted to tool names, timings, outcomes, and coarse error classes; paths, commands, arguments, and output are excluded.
- The flagged D-Bus dependency is imported only by the Wayland screenshot capture function.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
src/screenshot-portal.mjsView on unpkg · L249Package ships non-JavaScript build or shell helper files.
src/helpers/wayland_eis_sender.pyView on unpkgFindings
Affected versions and remediation
This report applies to @remcp/runtime@0.2.211.
See all versions of @remcp/runtime for other recorded verdicts.
- Review the evidence and your use of @remcp/runtime@0.2.211 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.