mtech-ai-local-runner@0.1.70
An answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client session id (Work Item e1c08b33). Among the sessions an answer names, the runner takes the one listed first, as long as a person typed in it
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest has no install-time hook, and the inspected entry points and integration code require direct invocation or explicit setup. Network and local agent integration behavior is consistent with a local AI runner; no concrete attack was identified.
Decision evidence
public snapshot- The manifest declares no install, preinstall, or postinstall script; its scripts are build, packaging, and explicit user commands.
- The CLI runs its main function only when invoked directly, not when imported.
- Integration files are installed only through the explicit integrations install command; the README says Codex hooks require user trust and are backed up before changes.
- The Codex pre-model gate accepts only a configured localhost MCP endpoint and rejects invalid endpoints.
- The alert opener runs only after the user selects the app’s Open button.
Source & flagged code
5 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.70.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.70 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.