Local Mcp MCP Server
https://local-mcp.com/mcp
Remote
v1.0
Published by local-mcp.com — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
180 local tools from ChatGPT, Claude.ai & desktop AIs: Mail, iMessage, Teams, files. Local, free.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 12.9 = 87. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −12.9 | Annotation contradicts behavior on "chrome_evaluate_js" ×6 MTC-CAP-003 | permissions |
2. Client adoption risk — 87 − 10 = 77. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 25
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: list_email_accounts → gdrive_list_files → chrome_evaluate_js. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow list_email_accounts → gdrive_list_files → chrome_evaluate_js
high Tool "chrome_evaluate_js" exposes command/code executionMTC-CAP-001
Tool "chrome_evaluate_js" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool chrome_evaluate_js
high Tool "run_terminal_command" exposes command/code executionMTC-CAP-001
Tool "run_terminal_command" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool run_terminal_command
high Tool "safari_evaluate_js" exposes command/code executionMTC-CAP-001
Tool "safari_evaluate_js" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool safari_evaluate_js
high Tool "web_eval" exposes command/code executionMTC-CAP-001
Tool "web_eval" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool web_eval
medium Tool "gdrive_write_file" can modify the filesystemMTC-CAP-002
Tool "gdrive_write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool gdrive_write_file
medium Tool "onedrive_delete_file" can modify the filesystemMTC-CAP-002
Tool "onedrive_delete_file" can write, overwrite or delete files (keyword "delete_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool onedrive_delete_file
medium Tool "onedrive_move_file" can modify the filesystemMTC-CAP-002
Tool "onedrive_move_file" can write, overwrite or delete files (keyword "move_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool onedrive_move_file
medium Tool "onedrive_write_file" can modify the filesystemMTC-CAP-002
Tool "onedrive_write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool onedrive_write_file
medium Annotation contradicts behavior on "chrome_evaluate_js"MTC-CAP-003
Tool "chrome_evaluate_js" advertises readOnlyHint=true but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool chrome_evaluate_js
medium Annotation contradicts behavior on "gdrive_write_file"MTC-CAP-003
Tool "gdrive_write_file" advertises destructiveHint=false but its derived capabilities include state-modifying actions (file-write). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool gdrive_write_file
medium Annotation contradicts behavior on "onedrive_write_file"MTC-CAP-003
Tool "onedrive_write_file" advertises destructiveHint=false but its derived capabilities include state-modifying actions (file-write). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool onedrive_write_file
medium Annotation contradicts behavior on "run_terminal_command"MTC-CAP-003
Tool "run_terminal_command" advertises destructiveHint=false but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool run_terminal_command
medium Annotation contradicts behavior on "safari_evaluate_js"MTC-CAP-003
Tool "safari_evaluate_js" advertises readOnlyHint=true but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool safari_evaluate_js
medium Annotation contradicts behavior on "web_eval"MTC-CAP-003
Tool "web_eval" advertises destructiveHint=false but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool web_eval
medium Unconstrained command parameter "script" on "chrome_evaluate_js"MTC-CAP-006
Tool "chrome_evaluate_js" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool chrome_evaluate_js · inputSchema.properties.script
medium Unconstrained command parameter "command" on "run_terminal_command"MTC-CAP-006
Tool "run_terminal_command" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool run_terminal_command · inputSchema.properties.command
medium Unconstrained command parameter "script" on "safari_evaluate_js"MTC-CAP-006
Tool "safari_evaluate_js" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool safari_evaluate_js · inputSchema.properties.script
low Unconstrained path parameter "path" on "gdrive_list_files"MTC-CAP-008
Tool "gdrive_list_files" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gdrive_list_files · inputSchema.properties.path
low Unconstrained path parameter "path" on "gdrive_read_file"MTC-CAP-008
Tool "gdrive_read_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gdrive_read_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "gdrive_write_file"MTC-CAP-008
Tool "gdrive_write_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool gdrive_write_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "onedrive_delete_file"MTC-CAP-008
Tool "onedrive_delete_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool onedrive_delete_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "onedrive_list_files"MTC-CAP-008
Tool "onedrive_list_files" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool onedrive_list_files · inputSchema.properties.path
low Unconstrained path parameter "path" on "onedrive_read_file"MTC-CAP-008
Tool "onedrive_read_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool onedrive_read_file · inputSchema.properties.path
low Unconstrained path parameter "path" on "onedrive_write_file"MTC-CAP-008
Tool "onedrive_write_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool onedrive_write_file · inputSchema.properties.path
Tools 234
Each tool and what it can reach — enumerated from the running server.
chrome_evaluate_jsruns code / shellcreate_referral_invitesnetwork egressgdrive_list_filesreads sensitive datagdrive_read_filereads sensitive datagdrive_write_filewrites fileslist_email_accountsingests untrusted inputlist_emailsingests untrusted inputlmcp_welcomeingests untrusted inputm365_read_emailingests untrusted inputm365_send_emailnetwork egress
Show 224 more tools ↓
onedrive_delete_filewrites filesonedrive_list_filesreads sensitive dataonedrive_move_filewrites filesonedrive_read_filereads sensitive dataonedrive_write_filewrites filesread_emailingests untrusted inputread_messagesingests untrusted inputrun_terminal_commandruns code / shellsafari_evaluate_jsruns code / shellsend_emailnetwork egresssend_messagenetwork egresssignal_connectingests untrusted inputsignal_list_chatsingests untrusted inputsignal_read_messagesingests untrusted inputsignal_send_messagenetwork egressteams_list_channelsingests untrusted inputteams_send_messagenetwork egressupdate_local_mcpingests untrusted inputweb_evalruns code / shellwhatsapp_connectingests untrusted inputwhatsapp_read_messagesingests untrusted inputwhatsapp_send_messagenetwork egresszalo_connectnetwork egresszalo_read_messagesingests untrusted inputzalo_send_messagenetwork egresschrome_clickno sensitive capabilitychrome_fill_formno sensitive capabilitychrome_go_backno sensitive capabilitychrome_list_tabsno sensitive capabilitychrome_navigateno sensitive capabilitychrome_query_selector_allno sensitive capabilitychrome_read_tabno sensitive capabilitychrome_search_tabsno sensitive capabilitychrome_setup_checkno sensitive capabilitychrome_typeno sensitive capabilitychrome_wait_forno sensitive capabilitycomplete_omnifocus_taskno sensitive capabilitycomplete_reminderno sensitive capabilityconnect_m365_accountno sensitive capabilityconnect_servicenowno sensitive capabilitycreate_calendar_eventno sensitive capabilitycreate_draftno sensitive capabilitycreate_email_folderno sensitive capabilitycreate_noteno sensitive capabilitycreate_omnifocus_taskno sensitive capabilitycreate_reminderno sensitive capabilitycreate_reminder_listno sensitive capabilitydaily_briefno sensitive capabilitydelete_calendar_eventno sensitive capabilitydelete_reminderno sensitive capabilitydelete_reminder_listno sensitive capabilitydisconnect_m365_accountno sensitive capabilitydisconnect_servicenowno sensitive capabilityexcel_createno sensitive capabilityexcel_readno sensitive capabilityexcel_write_cellno sensitive capabilityfinder_listno sensitive capabilityfinder_searchno sensitive capabilityfs_listno sensitive capabilityfs_readno sensitive capabilityfs_searchno sensitive capabilitygdrive_file_infono sensitive capabilitygdrive_rootno sensitive capabilitygdrive_search_filesno sensitive capabilityget_audit_logno sensitive capabilityget_configno sensitive capabilityget_contactno sensitive capabilityget_datetimeno sensitive capabilityget_m365_personno sensitive capabilityget_weatherno sensitive capabilitylist_accountsno sensitive capabilitylist_calendar_eventsno sensitive capabilitylist_calendar_namesno sensitive capabilitylist_contactsno sensitive capabilitylist_displaysno sensitive capabilitylist_email_foldersno sensitive capabilitylist_m365_people_insightsno sensitive capabilitylist_message_chatsno sensitive capabilitylist_notesno sensitive capabilitylist_omnifocus_foldersno sensitive capabilitylist_omnifocus_projectsno sensitive capabilitylist_omnifocus_tagsno sensitive capabilitylist_omnifocus_tasksno sensitive capabilitylist_referral_candidatesno sensitive capabilitylist_reminder_listsno sensitive capabilitylist_remindersno sensitive capabilitylist_safari_bookmarksno sensitive capabilitylist_windowsno sensitive capabilitylmcp_stateno sensitive capabilitym365_create_eventno sensitive capabilitym365_delete_eventno sensitive capabilitym365_get_contactno sensitive capabilitym365_list_contactsno sensitive capabilitym365_list_emailsno sensitive capabilitym365_list_eventsno sensitive capabilitym365_reply_emailno sensitive capabilitym365_search_contactsno sensitive capabilitym365_search_emailsno sensitive capabilitymedia_probeno sensitive capabilitymove_emailno sensitive capabilitynordvpn_diagnoseno sensitive capabilitynordvpn_serversno sensitive capabilitynordvpn_statusno sensitive capabilitynotion_list_databasesno sensitive capabilitynotion_list_pagesno sensitive capabilitynotion_list_workspacesno sensitive capabilitynotion_open_pageno sensitive capabilitynotion_read_databaseno sensitive capabilitynotion_read_pageno sensitive capabilitynotion_searchno sensitive capabilityonedrive_file_infono sensitive capabilityonedrive_rootno sensitive capabilityonedrive_search_filesno sensitive capabilityonedrive_set_scopeno sensitive capabilityoutlook_diagnoseno sensitive capabilitypdf_readno sensitive capabilitypermissions_statusno sensitive capabilityppt_createno sensitive capabilityppt_readno sensitive capabilityread_noteno sensitive capabilityrecipe_deleteno sensitive capabilityrecipe_getno sensitive capabilityrecipe_listno sensitive capabilityrecipe_runno sensitive capabilityrecipe_runsno sensitive capabilityrecipe_saveno sensitive capabilityrecord_markerno sensitive capabilityrename_reminder_listno sensitive capabilityreply_emailno sensitive capabilityreport_problemno sensitive capabilityrequest_featureno sensitive capabilityrun_diagnosticsno sensitive capabilitysafari_clickno sensitive capabilitysafari_fill_formno sensitive capabilitysafari_go_backno sensitive capabilitysafari_list_tabsno sensitive capabilitysafari_navigateno sensitive capabilitysafari_query_selector_allno sensitive capabilitysafari_read_tabno sensitive capabilitysafari_search_tabsno sensitive capabilitysafari_setup_checkno sensitive capabilitysafari_typeno sensitive capabilitysafari_wait_forno sensitive capabilitysave_attachmentno sensitive capabilityscreen_record_startno sensitive capabilityscreen_record_statusno sensitive capabilityscreen_record_stopno sensitive capabilityscreenshot_captureno sensitive capabilitysearch_contactsno sensitive capabilitysearch_emailsno sensitive capabilitysearch_m365_directoryno sensitive capabilitysearch_messagesno sensitive capabilitysearch_notesno sensitive capabilitysearch_omnifocus_tasksno sensitive capabilityservicenow_add_commentno sensitive capabilityservicenow_create_incidentno sensitive capabilityservicenow_get_incidentno sensitive capabilityservicenow_list_my_incidentsno sensitive capabilityservicenow_search_incidentsno sensitive capabilityservicenow_search_kbno sensitive capabilityservicenow_update_incidentno sensitive capabilitysetup_installno sensitive capabilitysignal_frictionno sensitive capabilitysignal_search_messagesno sensitive capabilityslack_list_channelsno sensitive capabilityslack_list_workspacesno sensitive capabilityslack_read_channel_messagesno sensitive capabilityslack_search_messagesno sensitive capabilitystocks_get_chartno sensitive capabilitystocks_get_quoteno sensitive capabilitystocks_search_symbolno sensitive capabilityteams_call_historyno sensitive capabilityteams_list_chatsno sensitive capabilityteams_list_teamsno sensitive capabilityteams_read_channel_messagesno sensitive capabilityteams_read_chat_messagesno sensitive capabilityteams_send_channel_messageno sensitive capabilitytodo_complete_taskno sensitive capabilitytodo_create_taskno sensitive capabilitytodo_list_listsno sensitive capabilitytodo_list_tasksno sensitive capabilityui_clickno sensitive capabilityui_find_elementno sensitive capabilityui_get_elementno sensitive capabilityui_keystrokeno sensitive capabilityui_menu_bar_clickno sensitive capabilityui_typeno sensitive capabilityui_wait_for_elementno sensitive capabilityupdate_calendar_eventno sensitive capabilityupdate_noteno sensitive capabilityupdate_reminderno sensitive capabilityupdate_self_diagnosisno sensitive capabilityvideo_blur_regionno sensitive capabilityvideo_concatno sensitive capabilityvideo_export_gifno sensitive capabilityvideo_reframeno sensitive capabilityvideo_trimno sensitive capabilityweb_clickno sensitive capabilityweb_extractno sensitive capabilityweb_findno sensitive capabilityweb_loginno sensitive capabilityweb_navigateno sensitive capabilityweb_readno sensitive capabilityweb_screenshotno sensitive capabilityweb_session_closeno sensitive capabilityweb_session_listno sensitive capabilityweb_showno sensitive capabilityweb_typeno sensitive capabilityweb_wait_forno sensitive capabilitywhatsapp_disconnectno sensitive capabilitywhatsapp_list_chatsno sensitive capabilitywhatsapp_search_messagesno sensitive capabilitywhatsapp_send_fileno sensitive capabilitywindow_focusno sensitive capabilitywindow_set_frameno sensitive capabilityword_appendno sensitive capabilityword_createno sensitive capabilityword_readno sensitive capabilityzalo_diagnoseno sensitive capabilityzalo_disconnectno sensitive capabilityzalo_list_chatsno sensitive capabilityzalo_search_messagesno sensitive capabilityzoom_list_recordingsno sensitive capabilityzoom_read_transcriptno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0 latest |
C 77/100 | 25 | 1.10.0 | 2026-07-24 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://local-mcp.com/mcp --onlineMore in Communication & Collaboration
One key, 100+ models — chat with any LLM and generate video, images, speech. Free trial at 370.ai.
Security scan results for the Adeu MCP server.
Security scan results for the Agentcanary MCP server.
Signal-first Bitcoin intelligence: sovereign, hiring & hashrate signals over MCP.
WhatsApp® reminders and rescheduling for Calendly. Public read-only MCP endpoint.
Security scan results for the Chat MCP server.