mtech-ai-local-runner@0.1.75
This local source supports newly approved executable V3 launches behind the Gateway's default-off `correction_execution_enabled` switch. It does not activate an installed runner or upgrade older V1/V2/unavailable-V3 approvals.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the README text flagged as reviewer manipulation is release documentation rather than an instruction to the reviewer. The reviewed network and submodule behavior fits the runner’s purpose and shows no unauthorized data flow or action.
Decision evidence
public snapshot- The manifest declares no install, preinstall, or postinstall hook; its scripts build or run explicit CLI commands.
- The README opening documents approved runner behavior and a Gateway feature switch; it does not instruct or pressure the security reviewer.
- Submodule materialization uses registered provider URLs and exact commit pins, and rejects nested submodules without registration authority.
- The configured Gateway endpoint is the destination for the runner’s bearer-authenticated tool requests.
Source & flagged code
6 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.75.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.75 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.