mtech-ai-local-runner@0.1.72
An answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client session id (Work Item e1c08b33). Among the sessions an answer names, the runner takes the one listed first, as long as a person typed in it
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the reviewed integration setup is explicitly opt-in. The network endpoint and hook behavior fit the package's local-runner purpose; the README scanner flag was not substantiated as review-directed manipulation.
Decision evidence
public snapshot- The manifest declares a CLI and build/command scripts, with no install, preinstall, or postinstall hook.
- The README says the guide hooks are disabled and installed only on request.
- The hook client communicates with a local socket using session ID and working-directory metadata.
- The integration code describes installing hooks only through explicit setup or integrations commands.
- The configured Gateway endpoint matches the package's stated service purpose.
- The package supports network communication with its Gateway as part of its local-runner purpose.
- The package includes native binaries that were not readable through the provided binary views.
Source & flagged code
6 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.72.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.