reflex-browser@0.15.1
Token-efficient browser automation for AI agents. Local MCP server + CLI: compressed page snapshots, batched actions, forensic failures.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package silently reports a first-call event with tool, outcome, platform/client and device metadata to its own API, while its README describes server data collection more narrowly. This is undisclosed runtime telemetry, but the observed fields do not show secret or page-content exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Automatically after the first MCP tool call in a server session.
Impact
The vendor receives usage and client metadata without clearly disclosing this reporting behavior; no page content or unrelated credentials were found in this event.
Mechanism
The package records tool outcome and client/platform metadata, then sends it with a device ID and the Reflex service key to `/v1/first-call`. The apparent telemetry gate is hard-coded off.
AI rationale
The package silently reports a first-call event with tool, outcome, platform/client and device metadata to its own API, while its README describes server data collection more narrowly. This is undisclosed runtime telemetry, but the observed fields do not show secret or page-content exfiltration.
Evidence
dist/mcp.js
Network endpoints1
reflex.openlabs.workers.dev
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After an MCP tool call, the package records a one-time first-call event containing the tool, result status, error category, platform and client details.
- It sends that event in a background POST to `/v1/first-call`, including the device ID and package/client versions.
- The apparent `REFLEX_METER` gate always returns false, so it does not disable this event.
- The README describes the server as handling key validation, credits and payments, but does not disclose this first-call reporting.
- The event goes to the package’s configured Reflex API, and the reported fields are limited usage metadata rather than page contents or credentials.
Evidence against
- The destination is the package’s own API service, and the event uses the package’s own service key.
- The README says page content, credentials and sessions stay local and that the credits server sees usage counts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
7 flaggeddist/reflex.jsView file
13cookie changes, emulate offline, geolocation, timezone and locale, state save. Downloads from your own
L14: tabs go to ~/Downloads while attached. All of these are read at daemon start, so run stop first`}});var zt=y((ol,G)=>{"use strict";var se=require("fs"),vn=require("path"),{execFile...
L15: `)){let s=n.match(/^\s*(\d+)\s+(.*)$/);if(s&&s[1]===o&&(/chrome|chromium|ms-playwright|playwright[\/\\]/i.test(s[2])||Ht(s[2],t)))return!0}return!1}function Bn(e,t){if(process.plat...
High
1#!/usr/bin/env node
L2: "use strict";var un=Object.create;var It=Object.defineProperty;var fn=Object.getOwnPropertyDescriptor;var dn=Object.getOwnPropertyNames;var hn=Object.getPrototypeOf,pn=Object.proto...
L3: `)[0]}. Start it with --remote-debugging-port=<port> and --user-data-dir=<dir> (Chrome ignores the port on its default profile), then retry.`)}async function An(e,t){let r;try{r=aw...
...
L13: cookie changes, emulate offline, geolocation, timezone and locale, state save. Downloads from your own
L14: tabs go to ~/Downloads while attached. All of these are read at daemon start, so run stop first`}});var zt=y((ol,G)=>{"use strict";var se=require("fs"),vn=require("path"),{execFile...
L15: `)){let s=n.match(/^\s*(\d+)\s+(.*)$/);if(s&&s[1]===o&&(/chrome|chromium|ms-playwright|playwri
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/reflex.jsFindings
6 High4 Medium5 Low
HighChild Processdist/reflex.js
HighSame File Env Network Executiondist/reflex.js
HighCredential Redirect Persistencedist/daemon.js
HighCommand Output Exfiltrationdist/daemon.js
HighSandbox Evasion Gated Capabilitydist/reflex.js
HighTrigger Reachable Command Output Exfiltrationdist/daemon.js
MediumDynamic Requiredist/reflex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to reflex-browser@0.15.1.
See all versions of reflex-browser for other recorded verdicts.
- Review the evidence and your use of reflex-browser@0.15.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.