Loading npm security reports…

local-mcp@3.0.374: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.374

local-mcp@3.0.374

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall automatically configures detected third-party AI clients to launch local-mcp. It downloads executable archives and, on macOS, installs a persistent tray LaunchAgent.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install -g local-mcp

Impact

Detected AI clients gain an automatically configured local MCP server without an explicit setup command.

Mechanism

postinstall MCP-config mutation, remote binary installation, and LaunchAgent persistence

Policy narrative

On global installation, the lifecycle hook calls setup with all clients enabled. Setup detects installed AI clients and injects a local-mcp launcher into their configuration, including removing an office-mcp entry in one config format. The same path obtains executable archives from remote endpoints; macOS additionally writes a LaunchAgent configured to start and remain alive. These are unconsented install-time mutations of foreign AI-agent control surfaces.

Rationale

This meets the blocking policy: a postinstall hook automatically mutates detected third-party AI-client MCP configurations. Remote executable installation and persistent LaunchAgent setup increase the impact. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonpostinstall.jssetup.jsdownload.js~/.claude.json~/.cursor/mcp.json~/.vscode/mcp.json~/.local/share/local-mcp/bin~/Applications/LocalMCPTray.app

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: const download = require('./download') ... L69: ' # curl telemetry — no Node dependency, fire-and-forget', L70: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L71: ' -H "Content-Type: application/json" \\', L72: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L73: ' pr

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

544Trigger-reachable chain: manifest.main -> index.js -> download.js L544: if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L545: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L546: } ... L557: L558: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L559: process.stderr.write(`\nDescargando tray v${version}...\n`) L560:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg · L544

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

1026Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L1026: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L1027: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L1028: // launchctl unload kills the running process AND prevents it from restarting L1029: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L1030: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L1040: try { L1041: const https = require('https') L1042: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L1026

Source & flagged code

13 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.374",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node --test test/*.test.js"

12 },

13 "files": [

14 "index.js",

15 "download.js",

16 "setup.js",

17 "postinstall.js",

18 "README.md"

19 ],

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "engines": {

21 "node": ">=18"

22 },

23 "os": [

24 "darwin",

25 "linux",

26 "win32"

27 ],

28 "keywords": [

29 "mcp",

30 "model-context-protocol",

download.jsView file

Lines 1-76javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

1026Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L1026: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L1027: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L1028: // launchctl unload kills the running process AND prevents it from restarting L1029: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L1030: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L1040: try { L1041: const https = require('https') L1042: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L1026

Lines 524-564javascript

524 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

525 const uninstalledMarkers = [

526 path.join(CACHE_DIR, '..', '.uninstalled'),

527 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

528 ]

529 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

530

531 const info = await getLatestBinary()

532 const version = info.version

533 const trayApp = TRAY_APP

534 const verFile = path.join(TRAY_DIR, '.version')

535

536 // Migrar instalación vieja de ~/.local/share si existe

537 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

538 if (fs.existsSync(oldTrayApp)) {

539 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

540 }

541

542 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

543 const systemTrayApp = '/Applications/LocalMCPTray.app'

544 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

545 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

546 }

547

548 // Ya instalado y actualizado

549 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

550 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

551 }

552

553 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

554 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

555 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

556 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

557

558 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

559 process.stderr.write(`\nDescargando tray v${version}...\n`)

560

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L544

561 fs.mkdirSync(TRAY_DIR, { recursive: true })

562 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

563

564 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto