Loading npm security reports…

local-mcp@3.0.371: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.371

local-mcp@3.0.371

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall silently configures every detected AI client to launch local-mcp and replaces office-mcp entries. The install chain also creates a persistent tray LaunchAgent and registers a machine identifier for a cloud tunnel.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g local-mcp on macOS

Impact

Third-party AI clients are changed to invoke package-controlled code; a persistent tray and cloud-tunnel identity are established.

Mechanism

Unconsented foreign MCP-config mutation with persistent remote-downloaded agent components

Policy narrative

On global macOS installation, the postinstall handler invokes setup with all clients enabled. Setup detects installed AI clients and writes MCP entries that run local-mcp, deleting office-mcp in standard MCP configs. It collects a stable machine identifier and registers an anonymous tunnel token. The same chain downloads a tray app and writes a KeepAlive LaunchAgent, creating persistence. These mutations occur without an explicit setup command or client-specific consent.

Rationale

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and machine-identity cloud registration. The global/macOS guards limit scope but do not supply consent.

Evidence

package.jsonpostinstall.jssetup.jsdownload.js~/Library/Application Support/Claude/claude_desktop_config.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: ... L60: ' # curl telemetry — no Node dependency, fire-and-forget', L61: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L62: ' -H "Content-Type: application/json" \\', L63: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L64: ' printf \'LMCP requires Node 16+. Current

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

430Trigger-reachable chain: manifest.main -> index.js -> download.js L430: if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L431: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L432: } ... L443: L444: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L445: process.stderr.write(`\nDescargando tray v${version}...\n`) L446:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg · L430

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

888Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L888: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L889: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L890: // launchctl unload kills the running process AND prevents it from restarting L891: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L892: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L902: try { L903: const https = require('https') L904: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L888

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.370 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.370 similarity = 1.000 summary = normalized source hash matched finalized malicious source

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.370 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.370 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.371",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "index.js",

14 "download.js",

15 "setup.js",

16 "postinstall.js",

17 "README.md"

18 ],

19 "engines": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "node": ">=18"

21 },

22 "os": [

23 "darwin",

24 "linux",

25 "win32"

26 ],

27 "keywords": [

28 "mcp",

29 "model-context-protocol",

30 "mcp-server",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

888Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L888: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L889: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L890: // launchctl unload kills the running process AND prevents it from restarting L891: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L892: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L902: try { L903: const https = require('https') L904: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L888

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.370 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.370 similarity = 1.000 summary = normalized source hash matched finalized malicious source

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.370 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.370 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Lines 410-450javascript

410 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

411 const uninstalledMarkers = [

412 path.join(CACHE_DIR, '..', '.uninstalled'),

413 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

414 ]

415 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

416

417 const info = await getLatestBinary()

418 const version = info.version

419 const trayApp = TRAY_APP

420 const verFile = path.join(TRAY_DIR, '.version')

421

422 // Migrar instalación vieja de ~/.local/share si existe

423 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

424 if (fs.existsSync(oldTrayApp)) {

425 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

426 }

427

428 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

429 const systemTrayApp = '/Applications/LocalMCPTray.app'

430 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

431 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

432 }

433

434 // Ya instalado y actualizado

435 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

436 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

437 }

438

439 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

440 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

441 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

442 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

443

444 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

445 process.stderr.write(`\nDescargando tray v${version}...\n`)

446

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L430

447 fs.mkdirSync(TRAY_DIR, { recursive: true })

448 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

449

450 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto