registry / machine-bridge-mcp / 0.2.0

machine-bridge-mcp@0.2.0

One-command hosted Remote MCP bridge to a local machine daemon.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package intentionally creates a Remote MCP bridge to a local daemon with filesystem read/write and shell execution enabled by default. This is a powerful user-invoked agent capability, but inspection did not find npm install-time execution, stealth persistence, credential harvesting, or hardcoded exfiltration.

Static reason

No blocking static signals were detected.

Trigger

User runs machine-mcp start or service install after installing the package.

Impact

Authorized remote MCP clients can read/write files and execute commands on the selected machine according to daemon policy; default policy is broad.

Mechanism

Authenticated MCP-to-local-daemon relay with optional login autostart

Rationale

The package is not malicious by LPM block criteria because dangerous behavior is explicit, package-aligned, authenticated, and user-invoked rather than npm install-time or stealthy. It should be warned due to broad default local read/write/exec capabilities and first-party autostart setup.

Evidence

package.jsonbin/machine-mcp.mjssrc/local/cli.mjssrc/local/daemon.mjssrc/local/service.mjssrc/local/api-server.mjssrc/worker/index.tsREADME.md~/.local/state/machine-bridge-mcp~/Library/LaunchAgents/dev.machine-bridge-mcp.daemon.plist~/.config/systemd/user/machine-bridge-mcp.service%APPDATA%/machine-bridge-mcpWindows Scheduled Task MachineBridgeMCP

Network endpoints3

api.openai.com/v1<worker>.<account>.workers.dev/mcpwss://<worker>.<account>.workers.dev/daemon/ws

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

src/local/daemon.mjs exposes read_file, write_file, search_text, and exec_command over a Worker WebSocket relay.
src/local/daemon.mjs resolvePath allows absolute paths and parent-directory traversal outside the workspace.
src/local/cli.mjs start installs autostart by default unless --no-autostart is passed.
src/local/service.mjs writes LaunchAgent, systemd user service, or Windows Scheduled Task entries.
src/worker/index.ts advertises write_file and exec_command as enabled by default through MCP.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook; only prepack/prepublishOnly developer checks.
bin/machine-mcp.mjs only imports CLI main and does not run on install or import by dependency consumers.
README.md clearly documents Remote MCP bridge behavior, default write/exec permissions, autostart, state paths, and uninstall commands.
Worker daemon WebSocket requires DAEMON_SHARED_SECRET and MCP clients require OAuth password flow.
No hardcoded exfiltration endpoint beyond user-deployed workers.dev relay and optional OpenAI-compatible upstream.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 122 KB of source, external domains: 127.0.0.1, api.openai.com, example.com, example.invalid, www.apple.com

Source & flagged code

2 flagged

src/local/service.mjsView file

Lines 1-31javascript

1import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { run } from "./shell.mjs";

5import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";

7const LABEL = "dev.machine-bridge-mcp.daemon";

8const WINDOWS_TASK = "MachineBridgeMCP";

10export async function installAutostart({ workspace, stateRoot, entryScript, policy, logger = console }) {

11 const spec = serviceSpec({ workspace, stateRoot, entryScript, policy });

12 if (process.platform === "darwin") return installLaunchd(spec, logger);

13 if (process.platform === "win32") return installWindowsTask(spec, logger);

14 return installSystemd(spec, logger);

15}

17export async function uninstallAutostart({ stateRoot, logger = console } = {}) {

18 if (process.platform === "darwin") return uninstallLaunchd(logger);

19 if (process.platform === "win32") return uninstallWindowsTask(logger);

20 return uninstallSystemd(logger);

21}

23export async function autostartStatus({ logger = console } = {}) {

24 if (process.platform === "darwin") return statusLaunchd(logger);

25 if (process.platform === "win32") return statusWindowsTask(logger);

26 return statusSystemd(logger);

27}

29export async function startAutostart({ logger = console } = {}) {

30 if (process.platform === "darwin") return startLaunchd(logger);

31 if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/local/service.mjsView on unpkg · L11

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg

Source & flagged code

2 flagged · loading source

src/local/service.mjsView file

11const spec = serviceSpec({ workspace, stateRoot, entryScript, policy }); L12: if (process.platform === "darwin") return installLaunchd(spec, logger); L13: if (process.platform === "win32") return installWindowsTask(spec, logger); ... L30: if (process.platform === "darwin") return startLaunchd(logger); L31: if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true }); L32: return run("systemctl", ["--user", "start", "machine-bridge-mcp.service"], { capture: true, allowFailure: true }); ... L50: node: process.execPath, L51: stdout: path.join(logs, "daemon.out.log"), L52: stderr: path.join(logs, "daemon.err.log"), ... L77: function launchdPlistPath() { L78: return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); L79: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/local/service.mjsView on unpkg · L11

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg

Findings

5 Medium5 Low

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/local/service.mjs

MediumShips Build Helpermbm.cmd

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/local/service.mjsView file

Lines 1-31javascript

1import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { run } from "./shell.mjs";

5import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";

7const LABEL = "dev.machine-bridge-mcp.daemon";

8const WINDOWS_TASK = "MachineBridgeMCP";

10export async function installAutostart({ workspace, stateRoot, entryScript, policy, logger = console }) {

11 const spec = serviceSpec({ workspace, stateRoot, entryScript, policy });

12 if (process.platform === "darwin") return installLaunchd(spec, logger);

13 if (process.platform === "win32") return installWindowsTask(spec, logger);

14 return installSystemd(spec, logger);

15}

17export async function uninstallAutostart({ stateRoot, logger = console } = {}) {

18 if (process.platform === "darwin") return uninstallLaunchd(logger);

19 if (process.platform === "win32") return uninstallWindowsTask(logger);

20 return uninstallSystemd(logger);

21}

23export async function autostartStatus({ logger = console } = {}) {

24 if (process.platform === "darwin") return statusLaunchd(logger);

25 if (process.platform === "win32") return statusWindowsTask(logger);

26 return statusSystemd(logger);

27}

29export async function startAutostart({ logger = console } = {}) {

30 if (process.platform === "darwin") return startLaunchd(logger);

31 if (process.platform === "win32") return run("schtasks", ["/Run", "/TN", WINDOWS_TASK], { capture: true, allowFailure: true });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/local/service.mjsView on unpkg · L11

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg