registry / @tianshu-ai/local-bridge / 0.5.0

@tianshu-ai/local-bridge@0.5.0

Local bridge for tianshu — dial into a tianshu server over WebSocket and expose your machine's tools (browser, files, shell) to the agent via reverse-MCP.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs tsbridge with --server, or starts the installed menu-bar app.

Impact

A connected remote agent can invoke the exposed browser tools, potentially acting within accessible browser sessions.

Mechanism

Reverse-MCP proxy to Playwright/CloakBrowser tools

Rationale

No concrete malicious or unconsented install-time behavior was found. The package deliberately provides a remote browser-control bridge, so its dangerous capability warrants a warning.

Evidence

package.jsondist/index.jsdist/connection.jsdist/mcp-child.jsdist/update.jsdist/install-app.jsapp/TianshuBridge.swiftREADME.md

Network endpoints2

127.0.0.1:9222registry.npmjs.org

Decision evidence

public snapshot

@tianshu-ai/local-bridge@0.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code