registry / safari-mcp / 2.15.2

safari-mcp@2.15.2

Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious payload or external exfiltration is established. The package installs a privileged browser-automation helper and exposes a localhost bridge for its extension.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; then user starts the MCP server and enables its browser extension.

Impact

A user-enabled MCP client can evaluate scripts and perform browser/input actions with existing Safari session access.

Mechanism

package-owned helper re-signing plus localhost browser automation bridge

Rationale

Source supports a real privileged agent-extension lifecycle and broad browser-control capability, warranting a warning. It does not show covert persistence outside its own state, foreign agent-config mutation, remote payload loading, or data exfiltration.

Evidence

package.jsonscripts/postinstall.cjsindex.jsextension/manifest.jsonextension/background.jssafari-helper.swiftsafari-helpersafari-helper.entitlements~/.safari-mcp-proxy-token~/.safari-mcp/owned-tabs.json

Network endpoints1

127.0.0.1:9224

safari-mcp@2.15.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code