registry / Remote code execution / screenpipe-mcp
screenpipe-mcp
MCP server for screenpipe - search your screen recordings and audio transcriptions
This report shows the evidence for screenpipe-mcp@0.19.4. 1 of 5 known versions is blocked or flagged. The newest version, 0.20.3, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package combines reviewer manipulation with automatic execution of unpinned remote code and credential handling. The lack of an npm install hook reduces scope but does not neutralize the startup execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Launching the stdio MCP server, or invoking its create-pipe tool.
Impact
A future screenpipe release can execute during package startup; local or enterprise credentials can be used in network requests and agent prompts can persist.
Mechanism
Automatic unpinned command execution, credential recovery, and scheduled prompt creation.
Attack narrative
On startup, the MCP server warms credential discovery without waiting for a tool call. The discovery path executes bun or npx with screenpipe@latest, allowing a newly published external package release to run in the user's environment. The package reads Screenpipe credentials and attaches them to API requests. Its reviewer-directed instruction also tells AI agents to edit files outside the package. The package exposes a tool that writes and enables scheduled prompts under the user's home directory.
AI rationale
The package combines reviewer manipulation with automatic execution of unpinned remote code and credential handling. The lack of an npm install hook reduces scope but does not neutralize the startup execution chain.
Evidence
src/index.tssrc/team-config.tspackage.jsonsrc/telemetry.tsdist/cli.js~/.screenpipe/enterprise.json~/.screenpipe/pipes/<name>/pipe.md
Network endpoints1
screenpi.pe/api/enterprise/v1
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- Source files instruct AI agents to modify files outside the package, which is reviewer-directed manipulation.
- Starting the stdio server automatically runs unpinned screenpipe@latest commands through bun or npx to obtain a token.
- The recovered token is attached as a bearer credential to runtime requests.
- It reads an enterprise token from the user's home configuration.
- An MCP call can write and enable scheduled pipe prompts in the user's home directory.
Evidence against
- package.json has no install, preinstall, or postinstall hook.
- The observed dynamic Function call is bundled validator code, not code fetched from a network response.
- Telemetry removes request, user, extra, and breadcrumb fields before sending events.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/http-server.jsView file
35544exports2.execAsync = undefined;
L35545: var child_process = require("child_process");
L35546: var util = require("util");
High
Child Process
Package source references child process execution.
dist/http-server.jsView on unpkg · L35544•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/http-server.js:
// node_modules/zod/v4/core/core.js
// node_modules/zod/v4/core/util.js
// node_modules/zod/v4/core/errors.js
// node_modules/zod/v4/core/parse.js
// node_modules/zod/v4/core/regexes.js
// node_modules/zod/v4/core/checks.js
// node_modules/zod/v4/core/doc.js
// node_modules/zod/v4/core/versions.js
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/http-server.jsView on unpkg159Cross-file remote execution chain: dist/http-server.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L159: assignProp: () => assignProp,
L160: base64ToUint8Array: () => base64ToUint8Array,
L161: base64urlToUint8Array: () => base64urlToUint8Array,
...
L924: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L925: } : { success: true, data: result.value };
L926: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
...
L1999: try {
L2000: new URL(`http://[${payload.value}]`);
L2001: } catch {
...
L9152: id = normalizeId(id);
L9153: return resolver.resolve(baseId, id);
L9154: }
Findings
3 Critical7 High6 Medium6 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/http-server.js
HighShell
HighEvaldist/cli.js
HighSame File Env Network Executiondist/index.js
HighEntrypoint Foreign Package Code Overwritedist/http-server.js
HighCross File Remote Execution Contextdist/http-server.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumSecret Patterndist/http-server.js
MediumNetwork
Medium
Affected versions and remediation
This report applies to screenpipe-mcp@0.19.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing screenpipe-mcp@0.19.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.