Loading npm security reports…
Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.
Static analysis completed at 0.0% confidence. No malicious behavior was detected; 23 low-signal pattern(s) were surfaced and cleared.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgA package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
download.jsView on unpkg · L544Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
download.jsView on unpkg · L544Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
download.jsView on unpkg · L7A manifest entrypoint or package-local install chain reaches persistence behavior.
download.jsView on unpkg · L7Source writes installer persistence such as shell profile or service configuration.
download.jsView on unpkg · L7A single source file combines environment access, network access, and code or shell execution with blocking evidence.
download.js#virtual:normalized:round1View on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
download.js#virtual:normalized:round1View on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
setup.jsView on unpkg · L45A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
setup.jsView on unpkg · L1026Source file is highly similar to a previously finalized malicious package; route for source-aware review.
setup.jsView on unpkgThis report applies to local-mcp@3.0.376.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L10Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L7A single source file combines environment access, network access, and code or shell execution with blocking evidence.
download.js#virtual:normalized:round1View on unpkg · L7A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
download.js#virtual:normalized:round1View on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
setup.jsView on unpkg · L45A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
setup.jsView on unpkg · L1026Source writes installer persistence such as shell profile or service configuration.
download.jsView on unpkg · L7Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
download.jsView on unpkg · L544A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
download.jsView on unpkg · L544Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
download.jsView on unpkg · L7A manifest entrypoint or package-local install chain reaches persistence behavior.
download.jsView on unpkg · L7Source file is highly similar to a previously finalized malicious package; route for source-aware review.
setup.jsView on unpkg