MCP server · Audited from source

lnwjud MCP server

by engasnm111/lnwjudMIT licenceAudited 6 Oct 2026 · source 3aab61d6dd63

npm fixture-node-vite 1.1.1stdiostreamable-http★ 198

✕BLOCKGrade F · 53/100 · 6 Oct 2026 · 3aab61d

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (53/100). It exposes 91 tools: 65 read, 24 write and 2 destructive. The audit recorded 45 findings (0 critical, 3 high, 9 medium, 23 low). Maintainer's description: lnwjud — local AI-agent runtime & MCP gateway

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “lnwjud MCP server (engasnm111/lnwjud)”. Retrieved 6 Oct 2026. https://modelsatlas.com/mcp/engasnm111/lnwjud

Why this is BLOCK. The audit found 0 critical and 3 high findings; the most severe is Filesystem / path at packages/shared/src/agent-policy.ts:90. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 6 Oct 2026

Trust score53/100✕BLOCK F

0 critical3 high9 medium23 low10 info

45 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared6 observations
NetworkNone observedNothing seen in the source
ShellDeclared3 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (45)

Sorted by severity · the 25 most severe of 45 are listed

HIGHFilesystem / pathfs.credential_store · packages/shared/src/agent-policy.ts:90

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

if (['id_rsa', 'id_ed25519', 'credentials', 'credentials.json', 'secrets.json', 'service-account.json'].includes(basename)) return true;

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · packages/workspace/src/secret-policy.ts:3

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

const PRIVATE_KEY_PREFIXES = ['id_rsa', 'id_ed25519'];

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · scripts/verify-release.ps1:45

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

($normalized -match '(^|/)(.+\.(pem|key)|id_rsa.*|id_ed25519.*|\.ssh/.*|\.aws/.*|credentials\.json)$')

Why: touches a credential store
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · apps/desktop/src/main/crash-recovery.ts:1

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync, readSync, statSync, writeFileSync } from 'node:fs';

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · apps/desktop/src/main/native-i18n.ts:1

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

import type { UiLocale, UpdateStatus } from '@lnwjud/ipc-contracts';

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · apps/desktop/tests/guided-tunnel-setup-ui.test.ts:156

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · apps/desktop/tests/tunnel-profile.test.ts:87

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · apps/desktop/tests/tunnel-profile.test.ts:121

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · apps/desktop/tests/watcher-server.test.ts:30

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/mcp-server/src/opaque-approval-summary.test.ts:36

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.github · packages/mcp-server/src/ecc-memory-vault.test.ts:54

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

delete_file, web_fetch

Why: 2 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.binary · docs/lnwjud-user-manual-th-v5.5.0.docx

F-13 Inventory / provenanceCWE-1104Layer L0

lnwjud-user-manual-th-v5.5.0.docx

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

LOWCode injectioncode.eval_exec · apps/desktop/tests/legacy-secret-migration.test.ts:48

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

await exec(powershell, ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', path.join(repositoryRoot, 'scripts/build-windows-secret-migrator.ps1')], { windowsHide: true, timeout: p

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · apps/desktop/tests/legacy-secret-migration.test.ts:52

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const fixture = await exec(powershell, ['-NoProfile', '-NonInteractive', '-Command',

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWInsecure cryptocrypto.weak_hash · packages/application/src/workspace-index.ts:252

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

const gitBlobSha = createHash('sha1').update(`blob ${content.byteLength}\0`).update(content).digest('hex');

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.credential_store · packages/workspace/src/secret-policy.test.ts:5

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

it.each(['.env', '.env.local', 'server.pem', 'private.key', 'id_ed25519', '.ssh\\id_ed25519', '.aws\\credentials', 'credentials.json'])('denies %s', (relativePath) => {

Why: touches a credential store
Fix: —

LOWFilesystem / pathfs.traversal · apps/desktop/e2e/tools-doctor.e2e.ts:204

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

const sourceHelper = path.join(desktopRoot, '../../native/windows-secret-migrator/bin/win-x64/lnwjud-windows-secret-migrator.exe');

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · apps/desktop/e2e/tools-doctor.e2e.ts:209

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

scriptPath: path.join(desktopRoot, '../../scripts/build-windows-secret-migrator.ps1'),

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · apps/desktop/e2e/tools-doctor.e2e.ts:249

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

LNWJUD_WINDOWS_SECRET_MIGRATOR: path.join(desktopRoot, '../../native/windows-secret-migrator/bin/win-x64/lnwjud-windows-secret-migrator.exe'),

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · apps/desktop/electron-builder.yml:31

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

- from: ../../.agents/skills/lnwjud-scheduled-continuation

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · apps/desktop/electron-builder.yml:33

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

- from: ../../.agents/skills/ponytail

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · FULL_README.md:263

F-04 Network egressCWE-200 · CWE-319Layer L1

5. **Member connection:** open the published custom lnwjud app in ChatGPT and press **Connect**. For the exact supported ChatGPT OAuth callback paths, the browser is handed once to a random short-live

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · FULL_README.md:267

F-04 Network egressCWE-200 · CWE-319Layer L1

The public ngrok URL is not the raw loopback MCP endpoint: requests must pass OAuth and bearer-token validation at the separate gateway. Do not publish `http://127.0.0.1:<port>/mcp` directly through a

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · FULL_README.md:303

F-04 Network egressCWE-200 · CWE-319Layer L1

$mcpEndpoint = 'http://127.0.0.1:<port>/mcp' # copy the actual endpoint shown by lnwjud

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

91 declared in source · 2 destructive

65 read24 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	What it does	Risk
`delete_file`	delete	destructive
`web_fetch`	Fetch an http/https URL (GET/POST/PUT/DELETE/HEAD) with bounded size and timeout. In standard mode every POST, PUT, or DELETE requires explicit chat confirmation and host approval; trusted Full Bypass skips lnwjud approval. dry_run remains safe. Returns status, headers, and text or base64 body.	destructive
`automation_control`	Pause, resume, or cancel one leased durable automation run. Cancellation also applies the run cancellation policy to its root Goal.	write
`automation_create`	Create one owner- and workspace-scoped durable shell automation run beneath an existing leased Goal. The plan must be a bounded acyclic milestone graph with evidence-producing verification for every milestone.	write
`automation_finalize`	Finalize a fully verified durable automation run and confirm its root Goal reached terminal completion. This fails closed while native scheduled-task cleanup is pending.	write
`automation_run`	Advance one leased durable automation run to its next deterministic dispatch, observation, or verification boundary. Repeat with the returned current revision; this operation never creates a scheduler.	write
`automation_status`	Read one durable automation run owned by the current actor in the requested workspace.	write
`clipboard`	Read or write the host clipboard (text or PNG image as base64). Use get_text/get_image to read and set_text to write.	write
`codex_run`	Delegate an instruction to the local Codex CLI in the Active Project. Starting Codex requires explicit chat confirmation and host approval in standard mode; trusted Full Bypass skips those lnwjud application checks without forging userConfirmed.	write
`codex_stop`	Stop an owned Codex task process after explicit chat confirmation in standard mode. Trusted Full Bypass skips the lnwjud confirmation gate; task ownership still applies.	write
`create_context_capsule`	Create and publish a bounded immutable context capsule from authoritative durable goal state for compact/resume or handoff. Stores decisions/results, not private chain-of-thought, and never opens, clicks, types into, or creates a ChatGPT browser conversation.	write
`engineering_start_task`	Start or resume a substantive Engineering Harness task by reusing the existing durable Goal authority. This operation does not create or authorize a scheduled continuation.	write
`file_dialog`	Open a host-native file open/save dialog and return the chosen path(s). The dialog does not read or write files itself; use the guarded file tools afterwards.	write
`git_status`	Inspect parsed read-only Git status. For writes (init, add, commit, remote, push, rm, clean, reset) use the git tool.	write
`list_checkpoints`	List encrypted pre-mutation checkpoints for one workspace without returning saved file content.	write
`list_goals`	List a bounded set of durable goals owned by the current stable MCP client, optionally filtered by workspace/status.	write
`process_stop`	Stop an owned managed process tree after explicit chat confirmation in standard mode. Trusted Full Bypass skips the lnwjud confirmation gate; exact process ownership still applies.	write
`reconcile_goals`	Preview or apply exact durable-goal reconciliation after runtime liveness checks.	write
`search_files`	Search workspace filenames with automatic context-economy filters; set includeIgnored for an explicit full path search. Absolute path does not require workspaceId.	write
`tool_batch`	Execute multiple MCP tools with parallel, dependency-aware, timeout, cancellation, and partial-result handling.	write
`update_goal_acceptance`	Update explicit durable acceptance criteria with evidence. finish_goal(status=completed) remains blocked until every criterion is completed.	write
`update_goal_plan`	Atomically replace the user-facing durable goal plan through the current lease and revision fence. It only updates plan state; it does not execute plan steps by itself.	write
`vision_annotated_capture`	Capture a local host screen/region/window and return a short-lived Set-of-Marks observation with numbered bounds, a content hash, and an annotated PNG when the host capture provider is ready. This tool only observes; use ui_target_action for a separately gated action.	write
`window`	Direct host-native window management. List, inspect, activate, move, resize, minimize, maximize, restore, or close windows when the active session provider proves the operation is supported.	write
`workspace_full_scan`	Enumerate workspace files with full access by default; set includeIgnored false to use the persistent automatic index.	write
`workspace_index_stop`	Stop a workspace watcher after draining all queued path updates.	write
`README`	Project docs	read
`Smoke`	Smoke	read
`advance_goal_iteration`	Advance one bounded review/improvement iteration under the durable goal lease. It never sends browser messages or creates an autonomous ChatGPT UI loop and cannot exceed maxIterations.	read
`automation_events`	Read a bounded page of durable automation events owned by the current actor in the requested workspace.	read
`b`	d	read
`codex_status`	Report local Codex installation and capabilities without credential inspection.	read
`codex_task_list`	List local Codex task handles owned by this client, including launches whose response was cancelled.	read
`codex_task_logs`	Read bounded logs for an owned Codex task.	read
`codex_task_status`	Read status for an owned Codex task.	read
`context_pressure`	Estimate local durable-context pressure from the goal snapshot and latest capsule. This never claims exact ChatGPT/provider context usage when the host does not expose it.	read
`copy_file`	Copy a file or directory within one workspace, creating missing destination parents.	read
`demo`	First line Second line	read
`diagnosing-bugs`	Diagnose hard bugs and performance regressions	read
`engineering_get_status`	Read the current Engineering Harness task projection, effective policy, required gates, blockers, and truthful delivery boundary without changing goal state.	read
`engineering_prepare_task`	Read-only Engineering Harness preparation. Assess the registered workspace, applicable project instructions, effective Engineering policy, and policy digest without creating a goal, starting a process, scheduling work, or writing repository files.	read
`frontend-design`	Design visual frontend interfaces	read
`get_context_capsule`	Read one immutable durable context capsule by ID.	read
`get_goal`	Read the latest durable goal snapshot without changing state or returning a lease token.	read
`get_goal_plan`	Read the user-facing plan projection, acceptance criteria, intent revision, and bounded-iteration policy from authoritative durable goal state. This is a projection, not a second workflow engine.	read
`git_diff`	Return a bounded read-only Git diff. For writes use the git tool.	read
`git_log`	Return bounded structured Git history. For writes use the git tool.	read
`hang`	Hang tool	read
`health`	Diagnostics only. Check all lnwjud backends or one public tool after a failure, when asked for status, or while diagnosing permissions. Do not use as a preflight before normal work.	read
`health_check`	Health	read
`list_context_capsules`	List bounded context-capsule lineage for one durable goal.	read
`list_delivery_receipts`	List bounded durable dispatch receipts for a goal.	read
`list_recovery_items`	List trusted Recovery Trash entries for one workspace, including deleted items, binary pre-replacement backups, original paths, timestamps, payload availability, and the local Recovery Trash root.	read
`mcp_describe`	Connect to one local MCP server (if needed) and return its tool names, descriptions, and input schemas. This operation only inspects the child tool catalog.	read
`mcp_list`	List local MCP servers discovered from Cursor, Claude Desktop, and lnwjud settings. This inspection is read-only and does not flatten child tools into the lnwjud catalog.	read
`notification`	Show a host-native desktop notification when a notification session is available. Use to tell the user when a long task finishes.	read
`ping`	Ping tool	read
`ponytail`	bundled primary	read
`ponytail-review`	bundled review	read
`process_list`	List managed process handles owned by this client in a workspace, including launches whose response was cancelled.	read
`process_logs`	Read bounded logs for an owned process handle. Prefer one bounded log read after meaningful progress rather than repeated status polling.	read
`process_status`	Read one status snapshot for an owned process handle. Do not tight-poll this tool; use project_* for normal project verification, or shell background + durable task_id for work expected to exceed ~5 minutes.	read
`project_snapshot`	Return a bounded project snapshot without source contents.	read
`read_file`	Read a workspace file as UTF-8 text or as an image/binary payload. Absolute host paths do not require workspaceId. For large files or an unknown location, prefer search_text first and then read_file_page for the relevant range instead of reading the whole file.	read
`read_file_page`	page	read
`read_file_page_continue`	Continue read_file_page from the next deterministic line chunk only when more surrounding context is needed; avoid re-reading earlier pages.	read
`read_files`	Read up to twenty bounded workspace files in parallel. Absolute paths do not require workspaceId. For large files, locate text with search_text and page with read_file_page instead of loading entire files.	read
`read_many_files`	Read many workspace files in parallel while preserving one result or error per requested path.	read
`record_delivery_receipt`	Record or advance a durable dispatch receipt with explicit ambiguous-delivery states. Blind retries are rejected by lifecycle/state and newer user intent can retire stale deliveries.	read
`remote_read`	Read remote data	read
`restore_checkpoint`	Restore a reviewed pre-mutation checkpoint. Standard mode requires explicit confirmation; trusted Full Bypass skips the lnwjud confirmation gate. A new rollback checkpoint is created before replacing current content when the target is inside a recoverable workspace.	read
`revise_goal_intent`	Record accepted newer user steering by incrementing userIntentRevision under the current lease. Older pending delivery receipts are retired so stale generated actions cannot outrank newer user instructions.	read
`schema_error_demo`	output schema error fixture	read
`search_all`	Search text and filenames across one or all registered workspaces with automatic economy filters or an explicit includeIgnored override.	read
`skills_list`	List the union of bundled skills and every discovered machine-global or active-workspace skill from Cursor, Claude, Agents, Codex, the Codex plugin cache, GitHub workspace roots, and lnwjud settings. Nested and symlinked skill collections are included. Filter with query or source.	read
`system_info`	Read-only system information: OS, CPU, memory, disks, battery, uptime, and top processes by memory. Use for environment checks and diagnostics.	read
`ui_target_action`	Act on one mark from a current vision_annotated_capture observation. The observation ID, optional hash, TTL, workspace owner, and current Accessibility element are checked before the action is sent.	read
`validate`	Validate fixture	read
`vision`	Visual and OCR fallback for content unavailable through DOM or host Accessibility. Capture a display, window, or region, or run local Vision OCR when the host capture permission/dependency is ready. It never clicks or types.	read
`workspace_context`	Aggregate ranked workspace context with snippets, symbols, Git/test relevance, economy metadata, and continuation; automatic discovery can be explicitly expanded.	read
`workspace_context_continue`	Continue a workspace_context result without discarding unreturned candidates.	read
`workspace_full_scan_continue`	Continue a workspace_full_scan result page.	read
`workspace_index`	Build or refresh the persistent workspace index using automatic context filters unless ignored paths are explicitly included.	read
`workspace_index_status`	Return persistent index metadata and lossless watcher queue telemetry.	read
`workspace_index_watch`	Watch all workspace paths and incrementally re-index only changed paths with configurable debounce/concurrency.	read
`workspace_info`	Return the configured workspace summary.	read
`workspace_list`	List registered project workspaces available to lnwjud. Legacy explicitly registered drive roots may also appear as kind=machine_root.	read
`workspace_register`	Register an existing project directory by absolute path. parentWorkspaceId is optional and retained only for legacy machine-root-relative registration. Idempotent for the same path.	read
`workspace_snapshot`	Return workspace identity and project snapshot metadata without source contents.	read
`workspace_tree`	List a bounded workspace tree. Absolute path does not require workspaceId.	read
`wsl_fs`	Translate paths and inspect metadata between a registered Windows workspace and WSL without exposing raw \\\\wsl$ read/write access.	read

Safer alternatives

Auten✓SAFE

auten-ai/auten-mcp

Computer use MCP server: give Claude Code, Codex, Cursor or any MCP client hands on your Mac, Windows or Linux desktop.

1 writeGrade B

Claude Auto-Approve✓SAFE

pynesys/claude_autoapprove_mcp

An MCP server to inject auto-approve MCP functionality into Claude Desktop

2 readGrade B

Audit history

2026-10-06
✕BLOCK F 53 / 100
Score 48 -> 53 · 3aab61d6dd63
2026-09-17
✕BLOCK F 48 / 100
First audit · b218af0638c4

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about lnwjud MCP server

What is the lnwjud MCP server?

lnwjud — local AI-agent runtime & MCP gateway

What tools does lnwjud expose?

91 in total: 65 read-only, 24 that write, and 2 that can delete or overwrite (delete_file, web_fetch). Every one is listed on this page with its risk.

Is lnwjud safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (53/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does lnwjud need?

It reads APPLE_API_KEY, CONTROL_PLANE_API_KEY, CSC_KEY_PASSWORD, LNWJUD_CHECKPOINT_KEY_BASE64, LNWJUD_E2E_EPHEMERAL_SECRETS, LNWJUD_REQUIRE_WINDOWS_AUTHENTICODE, LNWJUD_STDIO_FULL_BYPASS_ALL, LNWJUD_TEST_WINDOWS_SECRET_MIGRATOR and LNWJUD_WINDOWS_SECRET_MIGRATOR from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does lnwjud run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as fixture-node-vite at 1.1.1.

How current is this page?

The grade is for one exact copy of the source (3aab61d6dd63), read on 2026-10-06. The repository is watched and re-audited when it changes.

I already installed lnwjud. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

engasnm111/lnwjud on GitHub — the source we read, its licence, stars and activityObserved · 6 Oct 2026
ModelsAtlas trust audit — BLOCK verdict for commit 3aab61d6dd63Observed · 6 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the lnwjud MCP server?
GChatGPT CClaude PPerplexity
What tools does lnwjud expose?
GChatGPT CClaude PPerplexity
Is lnwjud safe to connect to an agent?
GChatGPT CClaude PPerplexity