registry / lazy_mobile_mcp / 1.1.0

lazy_mobile_mcp@1.1.0

Local MCP server for Android/iOS device automation and performance telemetry (ADB, simctl, devicectl, WDA)

AI Security Review

scanned 11h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `lazy-mobile-mcp setup-codex` or starts the MCP server.

Impact

Can replace the selected MCP entry and enable device automation under the invoking user's Codex environment.

Mechanism

Explicit Codex MCP registration plus local mobile-device command execution.

Rationale

Source inspection found no concrete malicious behavior or unconsented install-time agent-control mutation. Per policy, the explicit Codex setup mutation and device-control capability warrant a warning rather than a clean or block verdict.

Evidence

package.jsondist/cli.jsdist/setupCodex.jsdist/processRunner.jsdist/adapters/androidAdapter.jsdist/adapters/iosAdapter.jsdist/index.jsbin/lazy-mobile-mcp.js

Network endpoints2

127.0.0.1localhost

lazy_mobile_mcp@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code