registry / Credential exfiltration / screenpipe-mcp / 0.20.0

screenpipe-mcp@0.20.0

MCP server for screenpipe - search your screen recordings and audio transcriptions

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The unrestricted destination combined with automatic credential forwarding meets the conditional credential-exposure warning boundary. There is no install-time hook or fixed covert recipient, so blocking as malware is not supported.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

An MCP tool request that reaches fetchAPI after the launcher supplies an API URL override and a key is available or discovered.

Impact

A launcher or operator configuration mistake can expose an existing Screenpipe credential to an unintended endpoint; fetching and executing an unpinned latest CLI expands runtime supply-chain risk.

Mechanism

The entrypoint selects its base URL from environment variables, obtains a key from the environment or a screenpipe@latest command, and adds that key to the request Authorization header.

AI rationale

Evidence

dist/index.jssrc/self-contained-pack.test.ts

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has no npm install hook; its only lifecycle-like script is prepublishOnly.
The active stdio entry accepts SCREENPIPE_API_URL or SCREENPIPE_LOCAL_API_URL without an endpoint allowlist.
It obtains an existing Screenpipe API key from environment variables and sends it as a Bearer token to the selected API base.
When no key is present, it can execute an unpinned screenpipe@latest command through npx to obtain one.
A test-file header directly instructs AI agents to make changes outside the repository.

Evidence against

The default API base is localhost and the package metadata contains no dependencies or install-time script.
The credential forwarding requires a runtime API request and an operator-supplied endpoint override; no hidden fixed recipient was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

Source & flagged code

15 flagged

dist/http-server.jsView file

35293exports2.execAsync = undefined; L35294: var child_process = require("child_process"); L35295: var util = require("util");

High

Child Process

Package source references child process execution.

dist/http-server.jsView on unpkg · L35293

35289L35290: // node_modules/@[redacted]-id/execAsync.js L35291: var require_execAsync = __commonJS(function(exports2) {

High

Shell

Package source references shell execution.

dist/http-server.jsView on unpkg · L35289

19675patternName = generic_password severity = medium line = 19675

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/http-server.jsView on unpkg · L19675

dist/cli.jsView file

922return { L923: buildmetadata: match[5], L924: major: isNaN(major) ? undefined : major, ... L5033: const mimeType = match ? match[1] : "text/plain"; L5034: const isBase64 = url.includes(";base64,"); L5035: const dataStart = url.indexOf(","); ... L5382: try { L5383: const queryParams = new URL(url, "http://s.io").search.slice(1); L5384: return queryParams.length ? queryParams : undefined; ... L8090: } L8091: function addPrivateRequestAttributes(span, params, enableTruncation) { L8092: const messages = messagesFromParams(params);

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L922

50881Trigger-reachable chain: scripts.start -> dist/cli.js L50881: if (budgetLeft() > 0) { L50882: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L50883: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L50890: } catch {} L50891: process.stderr.write([ L50892: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L50896: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L50897: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L50898: "can resolve the key without bypassing Screenpipe's database boundary.",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L50881

44668sourceCode = this.opts.code.process(sourceCode, sch); L44669: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L44670: const validate = makeValidate(this, this.scope.get());

High

Eval

Package source references dynamic code evaluation.

dist/cli.jsView on unpkg · L44668

922Cross-file remote execution chain: dist/cli.js spawns dist/http-server.js; helper contains network access plus dynamic code execution. L922: return { L923: buildmetadata: match[5], L924: major: isNaN(major) ? undefined : major, ... L5033: const mimeType = match ? match[1] : "text/plain"; L5034: const isBase64 = url.includes(";base64,"); L5035: const dataStart = url.indexOf(","); ... L5382: try { L5383: const queryParams = new URL(url, "http://s.io").search.slice(1); L5384: return queryParams.length ? queryParams : undefined; ... L8090: } L8091: function addPrivateRequestAttributes(span, params, enableTruncation) { L8092: const messages = messagesFromParams(params);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L922

50881Trigger-reachable command-output exfiltration chain: scripts.start -> dist/cli.js L50881: if (budgetLeft() > 0) { L50882: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L50883: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L50890: } catch {} L50891: process.stderr.write([ L50892: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L50896: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L50897: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L50898: "can resolve the key without bypassing Screenpipe's database boundary.",

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L50881

4951patternName = generic_password severity = medium line = 4951

Medium

Secret Pattern

Hardcoded password in dist/cli.js

dist/cli.jsView on unpkg · L4951

dist/index.jsView file

49476if (budgetLeft() > 0) { L49477: const { stdout } = await execAsync("npx screenpipe@latest auth token", { L49478: timeout: Math.min(PER_CANDIDATE_MS, budgetLeft()), ... L49485: } catch {} L49486: process.stderr.write([ L49487: "[screenpipe-mcp] could not discover SCREENPIPE_LOCAL_API_KEY from any source.", ... L49491: "Fix: set SCREENPIPE_LOCAL_API_KEY in your MCP launcher's env block,", L49492: "or install the screenpipe desktop app (https://screenpi.pe) so its CLI", L49493: "can resolve the key without bypassing Screenpipe's database boundary.",

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L49476

49404port, L49405: env = process.env L49406: }) { L49407: return (baseOverride || env.SCREENPIPE_LOCAL_API_URL || env.SCREENPIPE_API_URL || (env.SCREENPIPE_LOCAL_API_PORT ? `http://localhost:${env.SCREENPIPE_LOCAL_API_PORT}` : `http://${h... L49408: } ... L49417: const fs = require("fs"); L49418: const { execFile, exec } = require("child_process"); L49419: const { promisify } = require("util");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L49404

18690patternName = generic_password severity = medium line = 18690

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L18690

scripts/assert-pack-contents.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/assert-pack-contents.js#virtual:normalized:round1View on unpkg

src/self-contained-pack.test.tsView file

•matchType = normalized_sha256 matchedPackage = screenpipe-mcp@0.19.4 matchedPath = src/self-contained-pack.test.ts matchedIdentity = npm:c2NyZWVucGlwZS1tY3A:0.19.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/self-contained-pack.test.tsView on unpkg

src/stdio-startup.test.tsView file

•matchType = token_shingles matchedPackage = screenpipe-mcp@0.19.4 matchedPath = src/stdio-startup.test.ts matchedIdentity = npm:c2NyZWVucGlwZS1tY3A:0.19.4 similarity = 0.750 shingleOverlap = 36 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/stdio-startup.test.tsView on unpkg

Source & flagged code

15 flagged · loading source

dist/http-server.jsView file

35293exports2.execAsync = undefined; L35294: var child_process = require("child_process"); L35295: var util = require("util");

High

Child Process

Package source references child process execution.

dist/http-server.jsView on unpkg · L35293

35289L35290: // node_modules/@[redacted]-id/execAsync.js L35291: var require_execAsync = __commonJS(function(exports2) {

High

Shell

Package source references shell execution.

dist/http-server.jsView on unpkg · L35289

19675patternName = generic_password severity = medium line = 19675

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/http-server.jsView on unpkg · L19675

dist/cli.jsView file

Findings

3 Critical9 High6 Medium6 Low

CriticalCommand Output Exfiltrationdist/index.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/http-server.js

HighShelldist/http-server.js

HighEvaldist/cli.js

HighSame File Env Network Executiondist/index.js

HighCross File Remote Execution Contextdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

HighSemantic Analysis Limitedscripts/assert-pack-contents.js#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/self-contained-pack.test.ts

Affected versions and remediation

This report applies to screenpipe-mcp@0.20.0.

See all versions of screenpipe-mcp for other recorded verdicts.

Review the evidence and your use of screenpipe-mcp@0.20.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 01:20:21.854Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.