registry / reflex-browser / 0.15.0
reflex-browser@0.15.0
Token-efficient browser automation for AI agents. Local MCP server + CLI: compressed page snapshots, batched actions, forensic failures.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged credential and command activity maps to Reflex login, usage metering, browser profile management, and process checks used by the browser tool. The sensitive Chrome profile seeding is documented and supports the package’s stated browser automation purpose; no malicious data flow was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the CLI or starts the MCP server; browser profile seeding occurs when the browser profile is first created.
Impact
The browser can use saved website logins for user-directed automation. The Reflex service receives usage metrics. No unrelated credential collection or destination was identified.
Mechanism
The login flow exchanges a user-authorized one-time code with the Reflex API and stores its key locally. Usage metrics are sent to the Reflex API; Chrome profile data is copied into a local Reflex profile for browser automation.
AI rationale
The flagged credential and command activity maps to Reflex login, usage metering, browser profile management, and process checks used by the browser tool. The sensitive Chrome profile seeding is documented and supports the package’s stated browser automation purpose; no malicious data flow was identified.
Evidence
~/.reflex/auth.json~/.reflex/profile/Chrome user profile files, including Local State, Cookies, and Login Data on Windows/Linux
Network endpoints2
reflexmcp.comreflex.openlabs.workers.dev
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes local browser automation and declares CLI binaries, with no install lifecycle hook.
- Login exchanges a one-time code with the Reflex login server and saves the returned Reflex API key locally.
- Usage reports go to the Reflex API and contain call counts, tool names, failure categories, platform, and response character counts.
- The README discloses persistent browser profiles and seeding from Chrome profiles as part of keeping sites signed in across runs.
Evidence against
- The package copies browser login data into its local automation profile by default on Windows and Linux, which is a sensitive capability disclosed in the README.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/reflex.jsView file
13cookie changes, emulate offline, geolocation, timezone and locale, state save. Downloads from your own
L14: tabs go to ~/Downloads while attached. All of these are read at daemon start, so run stop first`}});var zt=y((ol,G)=>{"use strict";var se=require("fs"),vn=require("path"),{execFile...
L15: `)){let s=n.match(/^\s*(\d+)\s+(.*)$/);if(s&&s[1]===o&&(/chrome|chromium|ms-playwright|playwright[\/\\]/i.test(s[2])||Ht(s[2],t)))return!0}return!1}function Bn(e,t){if(process.plat...
High
1#!/usr/bin/env node
L2: "use strict";var un=Object.create;var It=Object.defineProperty;var fn=Object.getOwnPropertyDescriptor;var dn=Object.getOwnPropertyNames;var hn=Object.getPrototypeOf,pn=Object.proto...
L3: `)[0]}. Start it with --remote-debugging-port=<port> and --user-data-dir=<dir> (Chrome ignores the port on its default profile), then retry.`)}async function An(e,t){let r;try{r=aw...
...
L13: cookie changes, emulate offline, geolocation, timezone and locale, state save. Downloads from your own
L14: tabs go to ~/Downloads while attached. All of these are read at daemon start, so run stop first`}});var zt=y((ol,G)=>{"use strict";var se=require("fs"),vn=require("path"),{execFile...
L15: `)){let s=n.match(/^\s*(\d+)\s+(.*)$/);if(s&&s[1]===o&&(/chrome|chromium|ms-playwright|playwri
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/reflex.jsFindings
6 High4 Medium5 Low
HighChild Processdist/reflex.js
HighSame File Env Network Executiondist/reflex.js
HighCredential Redirect Persistencedist/daemon.js
HighCommand Output Exfiltrationdist/daemon.js
HighSandbox Evasion Gated Capabilitydist/reflex.js
HighTrigger Reachable Command Output Exfiltrationdist/daemon.js
MediumDynamic Requiredist/reflex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to reflex-browser@0.15.0.
See all versions of reflex-browser for other recorded verdicts.
- Review the evidence and your use of reflex-browser@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.