registry / @tianshu-ai/local-bridge / 0.2.1

@tianshu-ai/local-bridge@0.2.1

Local bridge for tianshu — dial into a tianshu server over WebSocket and expose your machine's tools (browser, files, shell) to the agent via reverse-MCP.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `tianshu-local-bridge`/`npx` with `--server`; extra downstream tools require explicit `--browser-engine stealth`.

Impact

A connected server can operate the local browser and receive browser-derived content; stealth mode adds runtime third-party code execution risk.

Mechanism

Authenticated WebSocket-controlled browser automation with optional unpinned downstream MCP child.

Rationale

Source shows an overt local-agent bridge rather than covert install-time malware, but it deliberately exposes session-backed browser automation to a remote server and has an optional unpinned runtime child dependency. This warrants a warning for dangerous capability, not a publication block.

Evidence

package.jsondist/index.jsdist/connection.jsdist/browser.jsdist/mcp-child.jsREADME.md

Network endpoints1

127.0.0.1:9222

Decision evidence

public snapshot

@tianshu-ai/local-bridge@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code