com.local-mcp/local-mcp

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  fail25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "create_draft" param name "bcc": names an outbound copy/exfil destination (BCC/exfil verb). tool "run_diagnostics" description: names an outbound copy/exfil destination (BCC/exfil verb). tool "run_diagnostics" param "submit" description: names an outbound copy/exfil destination (BCC/exfil verb). tool "send_email" param name "bcc": names an outbound copy/exfil destination (BCC/exfil verb). tool "list_emails" description: bare 'IMPORTANT:' prose in a description (tag form is high-confidence; prose is warn). tool "read_email" description: cross-tool redirection ('instead of call…'). tool "report_problem" description: bare 'IMPORTANT:' prose in a description (tag form is high-confidence; prose is warn). tool "web_login" param "url" description: off-vendor URL in a description (www.linkedin.com); capability text should not name where data goes.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  install hook "postinstall" present and not a recognized benign build command

• Credential hygiene

  fail15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  tool "connect_servicenow" has a secret-shaped input parameter "password" — secrets must never be tool parameters (the model would supply/handle the credential). Reads secrets from the environment (e.g. download.js) — the recommended intake shape.

• Permission scope

  fail15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  HIGH: setup.js: references a sensitive credential path (/.cursor/) — the tool-poisoning exfiltration target. HIGH: shell/exec capability AND network egress together — download-and-execute risk (download.js: imports child_process and calls exec/spawn; setup.js: outbound HTTP/socket call). HIGH: shell/exec capability AND destructive filesystem writes together (download.js: imports child_process and calls exec/spawn; download.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename)). discloses shell/exec capability: download.js: imports child_process and calls exec/spawn discloses shell/exec capability: index.js: imports child_process and calls exec/spawn discloses shell/exec capability: setup.js: imports child_process and calls exec/spawn discloses broad/destructive filesystem access: download.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: download.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: index.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: index.js: path traversal ('../') combined with file access discloses broad/destructive filesystem access: setup.js: destructive/writing fs.* call (write/unlink/rm/chmod/rename) discloses broad/destructive filesystem access: setup.js: path traversal ('../') combined with file access Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 3.0.341 (patch bump): new tool "setup_install" touches a sensitive surface (email/exec/net/fs); new tool "chrome_click" appeared; new tool "chrome_evaluate_js" appeared; new tool "chrome_fill_form" appeared; new tool "chrome_go_back" appeared; new tool "chrome_list_tabs" touches a sensitive surface (email/exec/net/fs); new tool "chrome_navigate" touches a sensitive surface (email/exec/net/fs); new tool "chrome_query_selector_all" appeared; new tool "chrome_read_tab" touches a sensitive surface (email/exec/net/fs); new tool "chrome_search_tabs" appeared; new tool "chrome_setup_check" touches a sensitive surface (email/exec/net/fs); new tool "chrome_type" appeared; new tool "chrome_wait_for" appeared; new tool "complete_omnifocus_task" appeared; new tool "complete_reminder" appeared; new tool "connect_m365_account" appeared; new tool "connect_servicenow" appeared; new tool "create_calendar_event" touches a sensitive surface (email/exec/net/fs); new tool "create_draft" touches a sensitive surface (email/exec/net/fs); new tool "create_email_folder" touches a sensitive surface (email/exec/net/fs); new tool "create_note" appeared; new tool "create_omnifocus_task" appeared; new tool "create_referral_invites" touches a sensitive surface (email/exec/net/fs); new tool "create_reminder" appeared; new tool "create_reminder_list" appeared; new tool "daily_brief" touches a sensitive surface (email/exec/net/fs); new tool "delete_calendar_event" touches a sensitive surface (email/exec/net/fs); new tool "delete_reminder" touches a sensitive surface (email/exec/net/fs); new tool "delete_reminder_list" touches a sensitive surface (email/exec/net/fs); new tool "disconnect_m365_account" appeared; new tool "disconnect_servicenow" appeared; new tool "excel_create" touches a sensitive surface (email/exec/net/fs); new tool "excel_read" touches a sensitive surface (email/exec/net/fs); new tool "excel_write_cell" touches a sensitive surface (email/exec/net/fs); new tool "finder_list" touches a sensitive surface (email/exec/net/fs); new tool "finder_search" appeared; new tool "fs_list" touches a sensitive surface (email/exec/net/fs); new tool "fs_read" touches a sensitive surface (email/exec/net/fs); new tool "fs_search" touches a sensitive surface (email/exec/net/fs); new tool "gdrive_file_info" touches a sensitive surface (email/exec/net/fs); new tool "gdrive_list_files" appeared; new tool "gdrive_read_file" touches a sensitive surface (email/exec/net/fs); new tool "gdrive_root" appeared; new tool "gdrive_search_files" appeared; new tool "gdrive_write_file" touches a sensitive surface (email/exec/net/fs); new tool "get_audit_log" appeared; new tool "get_config" touches a sensitive surface (email/exec/net/fs); new tool "get_contact" appeared; new tool "get_datetime" appeared; new tool "get_m365_person" touches a sensitive surface (email/exec/net/fs); new tool "get_weather" touches a sensitive surface (email/exec/net/fs); new tool "list_accounts" touches a sensitive surface (email/exec/net/fs); new tool "list_calendar_events" appeared; new tool "list_calendar_names" appeared; new tool "list_contacts" appeared; new tool "list_displays" touches a sensitive surface (email/exec/net/fs); new tool "list_email_accounts" touches a sensitive surface (email/exec/net/fs); new tool "list_email_folders" touches a sensitive surface (email/exec/net/fs); new tool "list_emails" touches a sensitive surface (email/exec/net/fs); new tool "list_m365_people_insights" appeared; new tool "list_message_chats" appeared; new tool "list_notes" appeared; new tool "list_omnifocus_folders" appeared; new tool "list_omnifocus_projects" appeared; new tool "list_omnifocus_tags" appeared; new tool "list_omnifocus_tasks" appeared; new tool "list_referral_candidates" touches a sensitive surface (email/exec/net/fs); new tool "list_reminder_lists" appeared; new tool "list_reminders" appeared; new tool "list_safari_bookmarks" touches a sensitive surface (email/exec/net/fs); new tool "list_windows" appeared; new tool "lmcp_state" touches a sensitive surface (email/exec/net/fs); new tool "lmcp_welcome" touches a sensitive surface (email/exec/net/fs); new tool "m365_create_event" appeared; new tool "m365_delete_event" touches a sensitive surface (email/exec/net/fs); new tool "m365_get_contact" appeared; new tool "m365_list_contacts" appeared; new tool "m365_list_emails" touches a sensitive surface (email/exec/net/fs); new tool "m365_list_events" appeared; new tool "m365_read_email" touches a sensitive surface (email/exec/net/fs); new tool "m365_reply_email" touches a sensitive surface (email/exec/net/fs); new tool "m365_search_contacts" touches a sensitive surface (email/exec/net/fs); new tool "m365_search_emails" touches a sensitive surface (email/exec/net/fs); new tool "m365_send_email" touches a sensitive surface (email/exec/net/fs); new tool "media_probe" touches a sensitive surface (email/exec/net/fs); new tool "move_email" touches a sensitive surface (email/exec/net/fs); new tool "nordvpn_diagnose" touches a sensitive surface (email/exec/net/fs); new tool "nordvpn_servers" appeared; new tool "nordvpn_status" appeared; new tool "notion_list_databases" touches a sensitive surface (email/exec/net/fs); new tool "notion_list_pages" appeared; new tool "notion_list_workspaces" appeared; new tool "notion_open_page" appeared; new tool "notion_read_database" touches a sensitive surface (email/exec/net/fs); new tool "notion_read_page" touches a sensitive surface (email/exec/net/fs); new tool "notion_search" appeared; new tool "onedrive_delete_file" touches a sensitive surface (email/exec/net/fs); new tool "onedrive_file_info" touches a sensitive surface (email/exec/net/fs); new tool "onedrive_list_files" appeared; new tool "onedrive_move_file" touches a sensitive surface (email/exec/net/fs); new tool "onedrive_read_file" touches a sensitive surface (email/exec/net/fs); new tool "onedrive_root" appeared; new tool "onedrive_search_files" appeared; new tool "onedrive_set_scope" touches a sensitive surface (email/exec/net/fs); new tool "onedrive_write_file" touches a sensitive surface (email/exec/net/fs); new tool "outlook_diagnose" touches a sensitive surface (email/exec/net/fs); new tool "pdf_read" touches a sensitive surface (email/exec/net/fs); new tool "permissions_status" touches a sensitive surface (email/exec/net/fs); new tool "ppt_create" touches a sensitive surface (email/exec/net/fs); new tool "ppt_read" touches a sensitive surface (email/exec/net/fs); new tool "read_email" touches a sensitive surface (email/exec/net/fs); new tool "read_messages" touches a sensitive surface (email/exec/net/fs); new tool "read_note" touches a sensitive surface (email/exec/net/fs); new tool "recipe_delete" touches a sensitive surface (email/exec/net/fs); new tool "recipe_get" appeared; new tool "recipe_list" touches a sensitive surface (email/exec/net/fs); new tool "recipe_run" touches a sensitive surface (email/exec/net/fs); new tool "recipe_runs" touches a sensitive surface (email/exec/net/fs); new tool "recipe_save" appeared; new tool "record_marker" appeared; new tool "rename_reminder_list" appeared; new tool "reply_email" touches a sensitive surface (email/exec/net/fs); new tool "report_problem" appeared; new tool "request_feature" touches a sensitive surface (email/exec/net/fs); new tool "run_diagnostics" whose description contains exfiltration/BCC phrase; new tool "run_terminal_command" touches a sensitive surface (email/exec/net/fs); new tool "safari_click" appeared; new tool "safari_evaluate_js" appeared; new tool "safari_fill_form" appeared; new tool "safari_go_back" appeared; new tool "safari_list_tabs" touches a sensitive surface (email/exec/net/fs); new tool "safari_navigate" touches a sensitive surface (email/exec/net/fs); new tool "safari_query_selector_all" appeared; new tool "safari_read_tab" touches a sensitive surface (email/exec/net/fs); new tool "safari_search_tabs" appeared; new tool "safari_setup_check" appeared; new tool "safari_type" appeared; new tool "safari_wait_for" appeared; new tool "save_attachment" touches a sensitive surface (email/exec/net/fs); new tool "screen_record_start" appeared; new tool "screen_record_status" appeared; new tool "screen_record_stop" appeared; new tool "screenshot_capture" appeared; new tool "search_contacts" touches a sensitive surface (email/exec/net/fs); new tool "search_emails" touches a sensitive surface (email/exec/net/fs); new tool "search_m365_directory" touches a sensitive surface (email/exec/net/fs); new tool "search_messages" appeared; new tool "search_notes" appeared; new tool "search_omnifocus_tasks" appeared; new tool "send_email" touches a sensitive surface (email/exec/net/fs); new tool "send_message" touches a sensitive surface (email/exec/net/fs); new tool "servicenow_add_comment" appeared; new tool "servicenow_create_incident" appeared; new tool "servicenow_get_incident" appeared; new tool "servicenow_list_my_incidents" appeared; new tool "servicenow_search_incidents" appeared; new tool "servicenow_search_kb" appeared; new tool "servicenow_update_incident" appeared; new tool "signal_connect" touches a sensitive surface (email/exec/net/fs); new tool "signal_friction" touches a sensitive surface (email/exec/net/fs); new tool "signal_list_chats" touches a sensitive surface (email/exec/net/fs); new tool "signal_read_messages" touches a sensitive surface (email/exec/net/fs); new tool "signal_search_messages" appeared; new tool "signal_send_message" touches a sensitive surface (email/exec/net/fs); new tool "slack_list_channels" appeared; new tool "slack_list_workspaces" appeared; new tool "slack_read_channel_messages" touches a sensitive surface (email/exec/net/fs); new tool "slack_search_messages" appeared; new tool "stocks_get_chart" appeared; new tool "stocks_get_quote" touches a sensitive surface (email/exec/net/fs); new tool "stocks_search_symbol" appeared; new tool "teams_call_history" appeared; new tool "teams_list_channels" appeared; new tool "teams_list_chats" appeared; new tool "teams_list_teams" appeared; new tool "teams_read_channel_messages" touches a sensitive surface (email/exec/net/fs); new tool "teams_read_chat_messages" touches a sensitive surface (email/exec/net/fs); new tool "teams_send_channel_message" touches a sensitive surface (email/exec/net/fs); new tool "teams_send_message" touches a sensitive surface (email/exec/net/fs); new tool "todo_complete_task" appeared; new tool "todo_create_task" appeared; new tool "todo_list_lists" appeared; new tool "todo_list_tasks" appeared; new tool "ui_click" appeared; new tool "ui_find_element" appeared; new tool "ui_get_element" appeared; new tool "ui_keystroke" touches a sensitive surface (email/exec/net/fs); new tool "ui_menu_bar_click" appeared; new tool "ui_type" touches a sensitive surface (email/exec/net/fs); new tool "ui_wait_for_element" appeared; new tool "update_calendar_event" appeared; new tool "update_local_mcp" touches a sensitive surface (email/exec/net/fs); new tool "update_note" appeared; new tool "update_reminder" appeared; new tool "update_self_diagnosis" appeared; new tool "video_blur_region" touches a sensitive surface (email/exec/net/fs); new tool "video_concat" touches a sensitive surface (email/exec/net/fs); new tool "video_export_gif" appeared; new tool "video_reframe" appeared; new tool "video_trim" touches a sensitive surface (email/exec/net/fs); new tool "web_click" touches a sensitive surface (email/exec/net/fs); new tool "web_eval" touches a sensitive surface (email/exec/net/fs); new tool "web_extract" appeared; new tool "web_find" appeared; new tool "web_login" touches a sensitive surface (email/exec/net/fs); new tool "web_navigate" touches a sensitive surface (email/exec/net/fs); new tool "web_read" touches a sensitive surface (email/exec/net/fs); new tool "web_screenshot" appeared; new tool "web_session_close" appeared; new tool "web_session_list" touches a sensitive surface (email/exec/net/fs); new tool "web_show" appeared; new tool "web_type" appeared; new tool "web_wait_for" appeared; new tool "whatsapp_connect" touches a sensitive surface (email/exec/net/fs); new tool "whatsapp_disconnect" touches a sensitive surface (email/exec/net/fs); new tool "whatsapp_list_chats" appeared; new tool "whatsapp_read_messages" touches a sensitive surface (email/exec/net/fs); new tool "whatsapp_search_messages" appeared; new tool "whatsapp_send_file" touches a sensitive surface (email/exec/net/fs); new tool "whatsapp_send_message" touches a sensitive surface (email/exec/net/fs); new tool "window_focus" appeared; new tool "window_set_frame" appeared; new tool "word_append" appeared; new tool "word_create" appeared; new tool "word_read" touches a sensitive surface (email/exec/net/fs); new tool "zalo_connect" touches a sensitive surface (email/exec/net/fs); new tool "zalo_diagnose" appeared; new tool "zalo_disconnect" touches a sensitive surface (email/exec/net/fs); new tool "zalo_list_chats" appeared; new tool "zalo_read_messages" touches a sensitive surface (email/exec/net/fs); new tool "zalo_search_messages" appeared; new tool "zalo_send_message" touches a sensitive surface (email/exec/net/fs); new tool "zoom_list_recordings" touches a sensitive surface (email/exec/net/fs); new tool "zoom_read_transcript" touches a sensitive surface (email/exec/net/fs); new capability primitive(s) in source: child_process, fs-write, http-client; new hardcoded outbound host/BCC destination(s): download.local-mcp.com, github.com, local-mcp.com, office-mcp-production.up.railway.app, www.apple.com.

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote MCP endpoint declares NO authentication (unauthenticated remote — nginx-ui/CVE-2026-33032 class); manifest/source references Heartbeat behavior — disclosure