lanchuske-local-mcp

Security Findings (422)

• CriticalAS-006

  💻Arbitrary Code Execution ×2

  heuristic signal

  tool name or description implies arbitrary script/code execution (evaluate_script, execute javascript, etc.)

  chrome_evaluate_jssafari_evaluate_js

  Fix: This tool can execute arbitrary code or shell commands on the host system. Remove it unless strictly required. If kept: (1) restrict access to trusted users/agents only, (2) require human approval before each invocation (Claude Desktop: set approval_required: true; other clients: enable equivalent confirmation), (3) use the most restrictive sandbox or read-only mode available, and (4) never expose this tool to untrusted input sources.

• HighAS-005

  🔐Privilege Escalation

  run_terminal_command:tool description suggests privilege escalation: "sudo"

  Fix: Restrict OAuth/token scopes to the minimum necessary. Remove admin, :write wildcards, and any description-level escalation signals (sudo, impersonate).

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×63

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  chrome_evaluate_jschrome_list_tabschrome_navigatechrome_query_selector_allchrome_read_tabchrome_search_tabscreate_draftcreate_notecreate_omnifocus_taskexcel_createfinder_searchfs_searchgdrive_search_fileslist_email_accountslist_safari_bookmarkslmcp_statelmcp_welcomem365_create_eventm365_search_contactsm365_search_emailsm365_send_emailnotion_searchonedrive_search_filesonedrive_set_scopepermissions_statusread_emailrecipe_runreply_emailreport_problemrequest_featuresafari_evaluate_jssafari_list_tabssafari_navigatesafari_query_selector_allsafari_read_tabsafari_search_tabssearch_contactssearch_emailssearch_m365_directorysearch_messagessearch_notessearch_omnifocus_taskssend_emailservicenow_create_incidentservicenow_search_incidentsservicenow_search_kbservicenow_update_incidentsignal_list_chatssignal_search_messagesslack_search_messagesstocks_search_symbolupdate_local_mcpupdate_noteweb_clickweb_loginweb_session_listwhatsapp_connectwhatsapp_list_chatswhatsapp_read_messageswhatsapp_search_messageswhatsapp_send_filewhatsapp_send_messagezalo_search_messages

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions

  create_draft:input schema exposes 11 properties (threshold: 10)

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×234

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  setup_installchrome_clickchrome_evaluate_jschrome_fill_formchrome_go_backchrome_list_tabschrome_navigatechrome_query_selector_allchrome_read_tabchrome_search_tabschrome_setup_checkchrome_typechrome_wait_forcomplete_omnifocus_taskcomplete_reminderconnect_m365_accountconnect_servicenowcreate_calendar_eventcreate_draftcreate_email_foldercreate_notecreate_omnifocus_taskcreate_referral_invitescreate_remindercreate_reminder_listdaily_briefdelete_calendar_eventdelete_reminderdelete_reminder_listdisconnect_m365_accountdisconnect_servicenowexcel_createexcel_readexcel_write_cellfinder_listfinder_searchfs_listfs_readfs_searchgdrive_file_infogdrive_list_filesgdrive_read_filegdrive_rootgdrive_search_filesgdrive_write_fileget_audit_logget_configget_contactget_datetimeget_m365_personget_weatherlist_accountslist_calendar_eventslist_calendar_nameslist_contactslist_displayslist_email_accountslist_email_folderslist_emailslist_m365_people_insightslist_message_chatslist_noteslist_omnifocus_folderslist_omnifocus_projectslist_omnifocus_tagslist_omnifocus_taskslist_referral_candidateslist_reminder_listslist_reminderslist_safari_bookmarkslist_windowslmcp_statelmcp_welcomem365_create_eventm365_delete_eventm365_get_contactm365_list_contactsm365_list_emailsm365_list_eventsm365_read_emailm365_reply_emailm365_search_contactsm365_search_emailsm365_send_emailmedia_probemove_emailnordvpn_diagnosenordvpn_serversnordvpn_statusnotion_list_databasesnotion_list_pagesnotion_list_workspacesnotion_open_pagenotion_read_databasenotion_read_pagenotion_searchonedrive_delete_fileonedrive_file_infoonedrive_list_filesonedrive_move_fileonedrive_read_fileonedrive_rootonedrive_search_filesonedrive_set_scopeonedrive_write_fileoutlook_diagnosepdf_readpermissions_statusppt_createppt_readread_emailread_messagesread_noterecipe_deleterecipe_getrecipe_listrecipe_runrecipe_runsrecipe_saverecord_markerrename_reminder_listreply_emailreport_problemrequest_featurerun_diagnosticsrun_terminal_commandsafari_clicksafari_evaluate_jssafari_fill_formsafari_go_backsafari_list_tabssafari_navigatesafari_query_selector_allsafari_read_tabsafari_search_tabssafari_setup_checksafari_typesafari_wait_forsave_attachmentscreen_record_startscreen_record_statusscreen_record_stopscreenshot_capturesearch_contactssearch_emailssearch_m365_directorysearch_messagessearch_notessearch_omnifocus_taskssend_emailsend_messageservicenow_add_commentservicenow_create_incidentservicenow_get_incidentservicenow_list_my_incidentsservicenow_search_incidentsservicenow_search_kbservicenow_update_incidentsignal_connectsignal_frictionsignal_list_chatssignal_read_messagessignal_search_messagessignal_send_messageslack_list_channelsslack_list_workspacesslack_read_channel_messagesslack_search_messagesstocks_get_chartstocks_get_quotestocks_search_symbolteams_call_historyteams_list_channelsteams_list_chatsteams_list_teamsteams_read_channel_messagesteams_read_chat_messagesteams_send_channel_messageteams_send_messagetodo_complete_tasktodo_create_tasktodo_list_liststodo_list_tasksui_clickui_find_elementui_get_elementui_keystrokeui_menu_bar_clickui_typeui_wait_for_elementupdate_calendar_eventupdate_local_mcpupdate_noteupdate_reminderupdate_self_diagnosisvideo_blur_regionvideo_concatvideo_export_gifvideo_reframevideo_trimweb_clickweb_evalweb_extractweb_findweb_loginweb_navigateweb_readweb_screenshotweb_session_closeweb_session_listweb_showweb_typeweb_wait_forwhatsapp_connectwhatsapp_disconnectwhatsapp_list_chatswhatsapp_read_messageswhatsapp_search_messageswhatsapp_send_filewhatsapp_send_messagewindow_focuswindow_set_frameword_appendword_createword_readzalo_connectzalo_diagnosezalo_disconnectzalo_list_chatszalo_read_messageszalo_search_messageszalo_send_messagezoom_list_recordingszoom_read_transcript

  Fix: Review and remediate the identified issue.

• InfoAS-002

  ⚠️Excessive Permissions ×119

  declared capabilities: code/command execution

  chrome_evaluate_jsrecipe_runreport_problemsafari_evaluate_jswhatsapp_connect

  declared capabilities: network access

  chrome_list_tabschrome_navigatechrome_read_tabchrome_search_tabslist_safari_bookmarkslmcp_statem365_search_contactsm365_search_emailsnotion_searchpermissions_statusrequest_featuresafari_list_tabssafari_navigatesafari_read_tabsafari_search_tabssearch_emailssearch_messagessearch_notessearch_omnifocus_tasksservicenow_search_incidentsservicenow_search_kbstocks_search_symbolweb_loginweb_navigatezalo_search_messages

  declared capabilities: network access, database access

  chrome_query_selector_alllist_email_accountssafari_query_selector_allsignal_list_chats

  declared capabilities: filesystem access

  create_calendar_eventcreate_email_foldercreate_referral_invitescreate_remindercreate_reminder_listdelete_calendar_eventdelete_reminderdelete_reminder_listexcel_readexcel_write_cellfinder_listfs_listfs_readgdrive_file_infogdrive_list_filesgdrive_read_filegdrive_rootgdrive_write_fileget_m365_personlist_email_folderslist_noteslist_omnifocus_folderslist_reminder_listsm365_delete_eventmedia_probemove_emailnotion_read_pageonedrive_delete_fileonedrive_file_infoonedrive_list_filesonedrive_move_fileonedrive_read_fileonedrive_write_filepdf_readppt_createppt_readrecipe_deletescreen_record_startscreenshot_capturetodo_create_taskui_menu_bar_clickupdate_calendar_eventupdate_reminderupdate_self_diagnosisvideo_concatvideo_trimword_appendword_createword_read

  declared capabilities: filesystem access, HTTP requests

  create_draftexcel_createm365_create_eventonedrive_set_scopesend_emailupdate_notewhatsapp_send_file

  declared capabilities: code/command execution, filesystem access, HTTP requests

  create_note

  declared capabilities: code/command execution, filesystem access

  create_omnifocus_taskservicenow_create_incidentservicenow_update_incident

  declared capabilities: network access, filesystem access

  finder_searchfs_searchgdrive_search_fileslmcp_welcomeonedrive_search_filessearch_contactssearch_m365_directoryweb_session_list

  declared capabilities: HTTP requests

  m365_send_emailreply_emailwhatsapp_list_chatswhatsapp_read_messageswhatsapp_send_message

  declared capabilities: database access

  notion_list_databasesnotion_read_databasesignal_send_messageweb_findweb_wait_for

  declared capabilities: network access, HTTP requests

  read_emailsignal_search_messagesslack_search_messageswhatsapp_search_messages

  declared capabilities: code/command execution, network access, filesystem access

  run_terminal_command

  declared capabilities: network access, filesystem access, HTTP requests

  update_local_mcp

  declared capabilities: code/command execution, network access

  web_click

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-010

  🔑Insecure Secret Handling

  connect_servicenow:input parameter "password" accepts a credential (informational; not evidence of insecure handling)

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• InfoAS-006

  💻Arbitrary Code Execution

  web_eval:tool name or description implies arbitrary script/code execution — capability unconfirmed (no exec permission or code/script/eval input property found)

  Fix: This tool can execute arbitrary code or shell commands on the host system. Remove it unless strictly required. If kept: (1) restrict access to trusted users/agents only, (2) require human approval before each invocation (Claude Desktop: set approval_required: true; other clients: enable equivalent confirmation), (3) use the most restrictive sandbox or read-only mode available, and (4) never expose this tool to untrusted input sources.