Skills/npm/local-mcp

local-mcp@3.0.446

BLOCKED· startup only

Publisher claims: "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack, Notion & Office. Runs locally, no API keys." Observed in sandbox: sends data to office-mcp-production.up.railway.app.

Registry npm (MCP server)Publisher colibird-ai · publishing for 233 daysInstalls 18,176Last detonated 37 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Revoked: guards refuse to launch this version

confirmed incident: contacted office-mcp-production.up.railway.app (undeclared) Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.

Before you give it your token

It will ask for
LMCP_PRE_TOKENConfiguration, not credentials: INSTALL_ID, LMCP_APPLICATIONS_DIR, LMCP_CLIENTS_CATALOG_FILE, LMCP_DISABLE_TELEMETRY, LMCP_DISABLE_UPDATER, LMCP_MACHINE_ID, LMCP_METHOD, LMCP_REF, LMCP_SOURCE, npm_config_global, SKIP_SETUP, SystemRoot
Where it talks to
local-mcp.com (its own)Also railway.app, apple.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · contacted office-mcp-production.up.railway.app (undeclared)
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Credential pass-through configuration; Destructive file system command detected; Credential pass-through configuration. Summary: sends data to office-mcp-production.up.railway.app.

Behavior trace

Honeypot run · 21 s · 3 scenarios
t+CategoryObserved action
20sfilesystemread ~/.local/share/local-mcp/bin/.machine-id-v2 · ~/.local/share/local-mcp/bin/.cloud-token outside project
20snetworkCONNECT tcp://office-mcp-production.up.railway.app:443 · not in the allow-list, refused
20sclaimedstartup only: exited (0) before answering · Local MCP does not support Linux. It runs on macOS and Windows — https://local-mcp.com
20sprocessscript backend runs setup only
20sprocesssecond launch, clock +45 days, CI unset

Static findings

MEDIUM
npx invocation of non-well-known packageindex.js:10 · npx invocation of non-well-known package — may execute untrusted code* npx -y local-mcp@latest update → dice cómo actualizar (npx -y local-mcp@latest)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationunconfigure.js:519 · Credential pass-through configuration — agent relays sensitive credentials// left on Windows: the relay token and the device key in the Credential Manager, %APPDATA%\Local MCP,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagedownload.js:64 · npx invocation of non-well-known package — may execute untrusted code// older keep LocalMCPTray.app. The npx helper is ALSO named LMCP.app but has another bundle id, soFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageindex.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx -y local-mcp@latest setup → wizard de configuración de clientesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedlaunch-event.js:207 · Destructive file system command detected// con undefined si los dos fallan, devuelven basura o pasa el tope. Del cache y del hash delFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageindex.js:7 · npx invocation of non-well-known package — may execute untrusted code* npx -y local-mcp@latest → arranca el server MCP que trae el paquete (sin descargar nada); enFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelink.js:2 · npx invocation of non-well-known package — may execute untrusted code// #125 (decisión «A» de Darío, 2026-10-28): una máquina instalada con npx se vincula a la cuenta de laFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationlink.js:230 · Credential pass-through configuration — agent relays sensitive credentials// first_seen exists. The binary keeps the token where it keeps its relay token: the answer never carries it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagelink.js:19 · npx invocation of non-well-known package — may execute untrusted codeconst RESUME = 'npx -y local-mcp@latest link'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandlaunch-event.js:156 · Process kill command — agent can terminate processes// al server: hoy no la recibe por el wrapper, y sale al cerrarse stdin. Windows queda afuera: un kill ahí no pasa porFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Credential pass-through configurationdownload.js:116 · Credential pass-through configuration — agent relays sensitive credentials// The go-server reads its relay token ONLY from getCacheDir()/.cloud-token, a plain trimmed stringFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsetup.js:596 · Credential pass-through configuration — agent relays sensitive credentials// relay token; the tunnel only comes up after approval. A token that already exists is kept: setupFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationindex.js:352 · Credential pass-through configuration — agent relays sensitive credentials// #144: without the app, also the relay token, the device key, the Roaming config, logs and caches.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hidden zero-width characters detectedunconfigure.js:24 · Hidden zero-width characters detected — may conceal contentconst code = text.replace(/^/, ' ').split('')Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Credential pass-through configurationdownload.js:247 · Credential pass-through configuration — agent relays sensitive credentials// 2. the Go client's store; 3. no store and a relay token: the value a 3.0.420 client reportsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hidden zero-width characters detectedunconfigure.js:364 · Hidden zero-width characters detected — may conceal contentconst bom = text.startsWith('') ? '' : ''Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Process kill commandlaunch-event.js:124 · Process kill command — agent can terminate processes// Sin id de máquina: el id de Windows pide un probe de PowerShell. Un SIGKILL, o cualquier kill en Windows, no dejaFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebundled.js:9 · npx invocation of non-well-known package — may execute untrusted code* Authenticode-signed one. Updates arrive with `npx -y local-mcp@latest`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationsetup.js:482 · Credential pass-through configuration — agent relays sensitive credentials// lmcp-api#761 §1–2: the binary registers this installation's relay token (no tunnel) and beats once,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagedownload.js:132 · npx invocation of non-well-known package — may execute untrusted code// times per `npx … setup` run (once per tracked step); without memoizing,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageindex.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx -y local-mcp@latest uninstall → desinstalaFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedownload.js:401 · npx invocation of non-well-known package — may execute untrusted code* update cycle: npx put it back on every spawn — 140 addresses downloaded it 5-49 times a day.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationsetup.js:594 · Credential pass-through configuration — agent relays sensitive credentials// lmcp-npm#141, lmcp-api#761: Node registers no relay token and writes none. The binary does itFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationlink.js:228 · Credential pass-through configuration — agent relays sensitive credentials// lmcp-api#761 §1–2: before link, the binary registers the machine's relay token (without opening theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packageunconfigure.js:518 · npx invocation of non-well-known package — may execute untrusted code// lmcp-npm#144 (Darío, 2026-10-24, option 2): uninstalling removes everything npx setup and its serverFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesetup.js:23 · npx invocation of non-well-known package — may execute untrusted code// doesn't pick up an old npx from its own PATH (common with nvm users whoseFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepostinstall.js:16 · npx invocation of non-well-known package — may execute untrusted codeprocess.stderr.write('Run manually: npx -y local-mcp@latest setup\n\n')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesetup.js:24 · npx invocation of non-well-known package — may execute untrusted code// nvm default points to Node v11/v12 — those npx versions don't support -y).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelink.js:107 · npx invocation of non-well-known package — may execute untrusted code// the y/n question and by `npx -y local-mcp@latest link --approve|--deny`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageuser-agent.js:2 · npx invocation of non-well-known package — may execute untrusted code// Every outbound HTTP request from npx carries `User-Agent: LMCP-npm/<version> (<platform>)`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepostinstall.js:7 · npx invocation of non-well-known package — may execute untrusted code// Skip si: npx (no global), CI, o el usuario lo desactivóFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelink.js:81 · npx invocation of non-well-known package — may execute untrusted code// link tries again from the start. npx may have no app, so the text does not name one.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesetup.js:4 · npx invocation of non-well-known package — may execute untrusted code* Detecta clientes instalados y escribe la config npx automáticamente.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesetup.js:42 · npx invocation of non-well-known package — may execute untrusted code// Write a shell launcher script that wraps npx with a Node version check andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageunconfigure.js:2 · npx invocation of non-well-known package — may execute untrusted code// #48 (2): `npx local-mcp uninstall` quita la entrada `local-mcp` de las configs de los clientes de IAFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesetup.js:22 · npx invocation of non-well-known package — may execute untrusted code// Resolve absolute path to npx from the current Node binary so Claude DesktopFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepostinstall.js:4 · npx invocation of non-well-known package — may execute untrusted code* No corre cuando se usa npx (npm_config_global no está seteado).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelink.js:67 · npx invocation of non-well-known package — may execute untrusted codeconst SETUP_AGAIN = 'npx -y local-mcp@latest setup'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈92 tok
1 file · 12 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for local-mcp@3.0.446 as of 36 h ago. This is the package itself, not its dependencies.

What would make this Verified

35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.local/share/local-mcp/bin/.cloud-token.
  2. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  3. Unclaimed publisher≈ +8 on the totalClaim colibird-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim colibird-aiPropose a patch to the maintainer