Loading npm security reports…

local-mcp: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.373

local-mcp@3.0.373

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 2m ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall silently configures detected third-party AI clients to launch local-mcp. It downloads, extracts, and later executes backend-selected native payloads; the payload is not included for inspection.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g local-mcp

Impact

Installs a persistent MCP execution path in external AI clients and grants a remotely supplied binary execution on later client startup.

Mechanism

unconsented AI-client config mutation plus remote native-payload staging

Policy narrative

On global installation, postinstall calls runSetup({ all: true }). Setup detects third-party MCP clients and rewrites their configuration to launch local-mcp, removing an existing office-mcp entry. The same path downloads a native archive whose URL may be supplied by the backend, extracts it into the user cache, and index.js later spawns that binary. This creates an unconsented install-time AI-agent control-surface mutation and a remotely controlled executable staging chain.

Rationale

The automatic global postinstall mutates foreign AI-client configuration without a user command or prompt, meeting the blocking policy. Remote executable staging amplifies the control-surface takeover risk.

Evidence

postinstall.jssetup.jsdownload.jsindex.jspackage.json~/.cursor/mcp.json~/.vscode/mcp.json~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: ... L60: ' # curl telemetry — no Node dependency, fire-and-forget', L61: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L62: ' -H "Content-Type: application/json" \\', L63: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L64: ' printf \'LMCP requires Node 16+. Current

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

433Trigger-reachable chain: manifest.main -> index.js -> download.js L433: if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L434: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L435: } ... L446: L447: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L448: process.stderr.write(`\nDescargando tray v${version}...\n`) L449:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg · L433

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

875Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L875: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L876: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L877: // launchctl unload kills the running process AND prevents it from restarting L878: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L879: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L889: try { L890: const https = require('https') L891: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L875

Source & flagged code

13 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.373",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "index.js",

14 "download.js",

15 "setup.js",

16 "postinstall.js",

17 "README.md"

18 ],

19 "engines": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "node": ">=18"

21 },

22 "os": [

23 "darwin",

24 "linux",

25 "win32"

26 ],

27 "keywords": [

28 "mcp",

29 "model-context-protocol",

30 "mcp-server",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

875Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L875: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L876: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L877: // launchctl unload kills the running process AND prevents it from restarting L878: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L879: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L889: try { L890: const https = require('https') L891: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L875

Lines 413-453javascript

413 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

414 const uninstalledMarkers = [

415 path.join(CACHE_DIR, '..', '.uninstalled'),

416 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

417 ]

418 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

419

420 const info = await getLatestBinary()

421 const version = info.version

422 const trayApp = TRAY_APP

423 const verFile = path.join(TRAY_DIR, '.version')

424

425 // Migrar instalación vieja de ~/.local/share si existe

426 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

427 if (fs.existsSync(oldTrayApp)) {

428 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

429 }

430

431 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

432 const systemTrayApp = '/Applications/LocalMCPTray.app'

433 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

434 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

435 }

436

437 // Ya instalado y actualizado

438 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

439 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

440 }

441

442 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

443 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

444 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

445 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

446

447 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

448 process.stderr.write(`\nDescargando tray v${version}...\n`)

449

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L433

450 fs.mkdirSync(TRAY_DIR, { recursive: true })

451 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

452

453 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto