@remcp/runtime@0.2.229
First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.
AI Security Review
scanned 11h ago · by lpm-firewall-aiThe flagged dependency bridge is a lazy import of the declared D-Bus library used for requested Wayland screenshots. Telemetry is disclosed, limited to operational metrics, and sent through the paired agent; no package lifecycle hook or unrelated collector was identified.
Decision evidence
public snapshot- The package has no preinstall, install, or postinstall script; its declared scripts are for start, check, and test.
- Screenshot capture is invoked through the take_screenshot tool and uses the D-Bus client only when capture is requested in a Wayland session.
- Runtime telemetry whitelists tool names, timings, outcomes, and coarse error classes, and excludes paths, commands, arguments, and output.
- Telemetry is sent through the paired ReMCP agent; the CLI describes the metrics and provides ways to disable them.
- The optional temperature sensor dependency is restricted to macOS on arm64 and uses node-gyp for its install script.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
src/screenshot-portal.mjsView on unpkg · L259Package ships non-JavaScript build or shell helper files.
src/helpers/wayland_eis_sender.pyView on unpkgFindings
Affected versions and remediation
This report applies to @remcp/runtime@0.2.229.
See all versions of @remcp/runtime for other recorded verdicts.
- Review the evidence and your use of @remcp/runtime@0.2.229 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.