mtech-ai-local-runner@0.1.76
D6 owner revision `fbc30fbe-cac9-45d1-9eff-bccec6ee6a54` selects a separate Gateway-initiated P2 verification budget: at most 1,500 weighted minutes per UTC calendar month and one active verification per workspace. This does not cap or certify the entire
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the README's flagged text describes release review status rather than attempting to influence this review. The inspected CLI and transport behavior is consistent with an explicitly configured local runner using its AI Gateway service.
Decision evidence
public snapshot- package.json defines a CLI bin and has no install, preinstall, or postinstall lifecycle script.
- The README's flagged passage discusses release review status; it does not direct or manipulate this security review.
- The configured default network endpoint is the AI Gateway MCP service.
- Daemon setup is an explicit CLI mode and checks requested integration and feature options.
- The CLI calls main only when invoked directly.
Source & flagged code
5 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.76.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.