MCP server · Org-owned · Audited from source

Interceptor MCP server

by hacker-valley-media/InterceptorNOASSERTION licenceAudited 22 Oct 2026 · source 1b882289dfe6

npm interceptor 2.1.5stdio★ 562

✕BLOCKGrade F · 46/100 · 22 Oct 2026 · 1b88228

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (46/100). It exposes 22 tools: 19 read, 1 write and 2 destructive. The audit recorded 54 findings (0 critical, 6 high, 21 medium, 19 low). Maintainer's description: Browser automation and computer use for AI agents. One CLI and MCP server for your signed-in browser, native macOS apps, and real iPhones.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Interceptor MCP server (Hacker-Valley-Media/Interceptor)”. Retrieved 22 Oct 2026. https://modelsatlas.com/mcp/hacker-valley-media/interceptor

Why this is BLOCK. The audit found 0 critical and 6 high findings; the most severe is Inventory / provenance at shared/desktop-monitor-macos-payload-fixtures.json. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 22 Oct 2026

Trust score46/100✕BLOCK F

0 critical6 high21 medium19 low8 info

54 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared12 observations
NetworkDeclared17 observations
ShellDeclared6 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (54)

Sorted by severity · the 25 most severe of 54 are listed

HIGHInventory / provenanceinv.suspicious_name · shared/desktop-monitor-macos-payload-fixtures.json

F-13 Inventory / provenanceCWE-1104Layer L0

desktop-monitor-macos-payload-fixtures.json

Why: member named after an attack tool
Fix: remove or justify

HIGHInventory / provenanceinv.suspicious_name · shared/desktop-monitor-payload-fixtures.json

F-13 Inventory / provenanceCWE-1104Layer L0

desktop-monitor-payload-fixtures.json

Why: member named after an attack tool
Fix: remove or justify

HIGHCode injectioncode.eval_exec · interceptor-desktop/src/vm_guest.rs:258

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

fn exec(&mut self, argv: &[String], env: Option<&Value>, input: Option<&[u8]>, deadline: Instant, login: &impl Fn() -> Result<()>) -> Result<Value> {

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHNetwork egressnet.tls_off · daemon/ios/lockdown.ts:262

F-04 Network egressCWE-200 · CWE-319Layer L1

return { key: pair.HostPrivateKey, cert: pair.HostCertificate, rejectUnauthorized: false, minVersion: "TLSv1" }

Why: certificate verification is disabled
Fix: leave verification on

HIGHPrompt injectionprompt.hide_from_user · .agents/skills/interceptor-desktop/SKILL.md:64

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Never tell the user a command works because the help lists it. Say it works when its row is `effective: true`, or after you ran it.

Why: asks the agent to act without the user's knowledge
Fix: —

HIGHPrompt injectionprompt.hide_from_user · .agents/skills/interceptor-macos/references/permissions.md:94

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- **Restricted-by-policy.** `restricted` means the user *cannot* change it (parental controls, MDM). Don't tell the user to "click Allow" — there is no Allow option for them.

Why: asks the agent to act without the user's knowledge
Fix: —

MEDIUMInventory / provenanceinv.binary · daemon/ios/service-clients.ts

F-13 Inventory / provenanceCWE-1104Layer L0

service-clients.ts

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · scripts/Interceptor-Bridge-Developer-ID.provisionprofile

F-13 Inventory / provenanceCWE-1104Layer L0

Interceptor-Bridge-Developer-ID.provisionprofile

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.symlink · .claude/skills

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills

Why: link not followed
Fix: —

MEDIUMInventory / provenanceinv.symlink · .codex/skills

F-13 Inventory / provenanceCWE-1104Layer L0

.codex/skills

Why: link not followed
Fix: —

MEDIUMInventory / provenanceinv.symlink · .gemini/skills

F-13 Inventory / provenanceCWE-1104Layer L0

.gemini/skills

Why: link not followed
Fix: —

MEDIUMNetwork egressnet.beacon_words · cli/commands/monitor.ts:106

F-04 Network egressCWE-200 · CWE-319Layer L1

eventName === "beacon" ||

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · cli/commands/monitor.ts:334

F-04 Network egressCWE-200 · CWE-319Layer L1

case "beacon":

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · cli/commands/monitor.ts:1142

F-04 Network egressCWE-200 · CWE-319Layer L1

start    Begin recording on the active interceptor-group tab. --capture page-comm includes WebSocket/Beacon/BroadcastChannel events; --reload captures from page start.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · cli/help.ts:455

F-04 Network egressCWE-200 · CWE-319Layer L1

interceptor net monitor on [--reload]      Arm WebSocket/Beacon/BroadcastChannel capture

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · cli/help.ts:458

F-04 Network egressCWE-200 · CWE-319Layer L1

interceptor net page-comm log              Captured WebSocket/Beacon/BroadcastChannel events

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · bench-head-to-head/src/lifecycle.ts:78

F-04 Network egressCWE-200 · CWE-319Layer L1

const health = shellResult("curl -sf http://127.0.0.1:3241/health")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · bench-head-to-head/src/lifecycle.ts:86

F-04 Network egressCWE-200 · CWE-319Layer L1

const pageResp = shellResult(`curl -sf http://127.0.0.1:3241${page.path}`)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · bench-head-to-head/src/server.ts:54

F-04 Network egressCWE-200 · CWE-319Layer L1

console.log(`bench-head-to-head fixture server listening on http://127.0.0.1:${port}`)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · scripts/desktop-parity/cases/media.ts:48

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const PNG = "iVBORw0KGgoAAAANSUhEUgAAAIAAAAAkCAAAAABk2G3vAAAAOGVYSWZNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAACoAIABAAAAAEAAACAoAMABAAAAAEAAAAkAAAAAO7hHxsAAAOZSURBVFgJ7ZdtaJVlGMd/z85xO0tnvkXLtMxgr82crVTGWsG

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · scripts/desktop-parity/cases/personal.ts:61

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const JPEG = Buffer.from("/9j/4AAQSkZJRgABAgAAAQABAAD/4QDARXhpZgAATU0AKgAAAAgABQEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAEAAAITAAMAAAABAAEAAIdpAAQAAAABAAAAWgAAAAAAAAABAAAAAQAAAAEAAAABAAWQAAAHAAAABD

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · scripts/desktop-parity/cases/personal.ts:62

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const PNG = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAIAAAAlC+aJAAAACXBIWXMAAAABAAAAAQBPJcTWAAAAZElEQVR4nO3PQQ3AIADAQEgQhCrEomoieFyW9BS08549/mzpgFcNaA1oDWgNaA1oDWgNaA1oDWgNaA1oDWgNaA1oDWgNaA1oDWg

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · scripts/desktop-parity/cases/personal.ts:63

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const MP4 = Buffer.from("AAAAIGZ0eXBpc29tAAACAGlzb21pc28yYXZjMW1wNDEAAANUbW9vdgAAAGxtdmhkAAAAAAAAAAAAAAAAAAAD6AAAA+gAAQAAAQAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · shared/desktop-accessibility-fixtures.json:1271

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

"query": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · scripts/desktop-parity/cases/helpers.ts:10

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

try { return JSON.parse(readFileSync(path, "utf8").replace(/^/, "")) } catch { return {} }

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

22 declared in source · 2 destructive

19 read1 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	What it does	Risk
`--no-reuse`	force a new tab (overrides the named-group reuse default)	destructive
`--off`	tab keepalive: clear the flag so the page reads its real visibility again	destructive
`--no-read`	skip the post-action tree read	write
`--activate`	foreground the tab (default is background-first)	read
`--append`	type without clearing the field first	read
`--elements-only`	return accessible element matches only	read
`--full`	lift the 8K text cap (up to 200K)	read
`--include-frames`	walk all reachable frames (refs become e<frameId>_<n>)	read
`--markdown`	render text as markdown (headings/bold/lists/tables preserved)	read
`--no-wait`	return immediately after tab creation	read
`--reuse`	navigate the most recent managed tab instead of opening a new one (the DEFAULT for --group calls, per the extension	read
`--text-only`	skip tree	read
`--tree-only`	skip text	read
`--trusted`	HID-sourced input — page sees isTrusted: true; requires the target tab active in the OS-focused window (refuses otherwise, never moves focus)	read
`com.interceptor.host`	Interceptor daemon bridge	read
`interceptor_browser`	No description in the source	read
`interceptor_desktop`	No description in the source	read
`interceptor_ios`	No description in the source	read
`interceptor_local`	No description in the source	read
`interceptor_macos`	No description in the source	read
`interceptor_raw`	No description in the source	read
`interceptor_read`	No description in the source	read

Safer alternatives

All browser automation servers →

Boxlite✓SAFE

boxlite-labs/boxlite-mcp

Powered by BoxLite - embeddable sandbox with hardware-level isolation and no daemon. The SQLite of sandbox, coming soon as open source.

5 readGrade B

Web Agent Protocol✓SAFE

ota-tech-ai/web-agent-protocol

🌐Web Agent Protocol (WAP) - Record and replay user interactions in the browser with MCP support

2 readGrade B

Browser Use✓SAFE

jovanipink/mcp-browser-use

FastAPI MCP server that exposes browser-use automation through a testable Model Context Protocol boundary.

1 writeGrade B

Audit history

2026-10-22
✕BLOCK F 46 / 100
First audit · 1b882289dfe6

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Interceptor MCP server

What is the Interceptor MCP server?

Browser automation and computer use for AI agents. One CLI and MCP server for your signed-in browser, native macOS apps, and real iPhones.

What tools does Interceptor expose?

22 in total: 19 read-only, 1 that write, and 2 that can delete or overwrite (--no-reuse, --off). Every one is listed on this page with its risk.

Is Interceptor safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (46/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Interceptor need?

It reads INTERCEPTOR_IOS_SECRETS_PATH, INTERCEPTOR_PARITY_SUDO_PASSWORD, INTERCEPTOR_SECRETS_META, INTERCEPTOR_SECRETS_SERVICE, INTERCEPTOR_SPARKLE_PUBLIC_KEY and INTERCEPTOR_WINDOWS_BUILD_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Interceptor run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as interceptor at 2.1.5.

How current is this page?

The grade is for one exact copy of the source (1b882289dfe6), read on 2026-10-22. The repository is watched and re-audited when it changes.

I already installed Interceptor. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

Hacker-Valley-Media/Interceptor on GitHub — the source we read, its licence, stars and activityObserved · 22 Oct 2026
ModelsAtlas trust audit — BLOCK verdict for commit 1b882289dfe6Observed · 22 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Interceptor MCP server?
GChatGPT CClaude PPerplexity
What tools does Interceptor expose?
GChatGPT CClaude PPerplexity
Is Interceptor safe to connect to an agent?
GChatGPT CClaude PPerplexity