registry / machine-bridge-mcp / 0.1.0

machine-bridge-mcp@0.1.0

One-command hosted Remote MCP bridge to a local machine daemon.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 95.7 KB of source, external domains: example.invalid, www.apple.com

Source & flagged code

2 flagged

src/local/service.mjsView file

Lines 1-31javascript

1import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { run } from "./shell.mjs";

5import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";

7const LABEL = "dev.machine-bridge-mcp.daemon";

8const WINDOWS_TASK = "MachineBridgeMCP";

10export async function installAutostart({ workspace, stateRoot, entryScript, policy, logger = console }) {

11 const spec = serviceSpec({ workspace, stateRoot, entryScript, policy });

12 if (process.platform === "darwin") return installLaunchd(spec, logger);

13 if (process.platform === "win32") return installWindowsTask(spec, logger);

14 return installSystemd(spec, logger);

15}

17export async function uninstallAutostart({ stateRoot, logger = console } = {}) {

18 if (process.platform === "darwin") return uninstallLaunchd(logger);

19 if (process.platform === "win32") return uninstallWindowsTask(logger);

20 return uninstallSystemd(logger);

21}

23export async function autostartStatus({ logger = console } = {}) {

24 if (process.platform === "darwin") return statusLaunchd(logger);

25 if (process.platform === "win32") return statusWindowsTask(logger);

26 return statusSystemd(logger);

27}

29export async function startAutostart({ logger = console } = {}) {

30 if (process.platform === "darwin") return startLaunchd(logger);

31 if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/local/service.mjsView on unpkg · L11

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg

Source & flagged code

2 flagged · loading source

src/local/service.mjsView file

11const spec = serviceSpec({ workspace, stateRoot, entryScript, policy }); L12: if (process.platform === "darwin") return installLaunchd(spec, logger); L13: if (process.platform === "win32") return installWindowsTask(spec, logger); ... L30: if (process.platform === "darwin") return startLaunchd(logger); L31: if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true }); L32: return run("systemctl", ["--user", "start", "machine-bridge-mcp.service"], { capture: true, allowFailure: true }); ... L50: node: process.execPath, L51: stdout: path.join(logs, "daemon.out.log"), L52: stderr: path.join(logs, "daemon.err.log"), ... L77: function launchdPlistPath() { L78: return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); L79: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/local/service.mjsView on unpkg · L11

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg

Findings

5 Medium4 Low

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/local/service.mjs

MediumShips Build Helpermbm.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/local/service.mjsView file

Lines 1-31javascript

1import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { run } from "./shell.mjs";

5import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";

7const LABEL = "dev.machine-bridge-mcp.daemon";

8const WINDOWS_TASK = "MachineBridgeMCP";

10export async function installAutostart({ workspace, stateRoot, entryScript, policy, logger = console }) {

11 const spec = serviceSpec({ workspace, stateRoot, entryScript, policy });

12 if (process.platform === "darwin") return installLaunchd(spec, logger);

13 if (process.platform === "win32") return installWindowsTask(spec, logger);

14 return installSystemd(spec, logger);

15}

17export async function uninstallAutostart({ stateRoot, logger = console } = {}) {

18 if (process.platform === "darwin") return uninstallLaunchd(logger);

19 if (process.platform === "win32") return uninstallWindowsTask(logger);

20 return uninstallSystemd(logger);

21}

23export async function autostartStatus({ logger = console } = {}) {

24 if (process.platform === "darwin") return statusLaunchd(logger);

25 if (process.platform === "win32") return statusWindowsTask(logger);

26 return statusSystemd(logger);

27}

29export async function startAutostart({ logger = console } = {}) {

30 if (process.platform === "darwin") return startLaunchd(logger);

31 if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/local/service.mjsView on unpkg · L11

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg