Atlas / MCP servers / hashfunction / MarkuprPlus

MarkuprPlusBLOCK

mcp/hashfunction/markuprplus

Record your screen, narrate the bug, and hand your AI coding agent structured Markdown - one annotated screenshot per mark. Desktop app, CLI, and MCP server for Claude Code, Cursor, Codex, and Windsurf. On-device Whisper transcription, local-first, MIT.

Verdict
BLOCK
Grade
F
Trust score
40 /100
Exposed tools
21 17r · 4w · 0d
Transport
stdio
License
MIT
Stars
79
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

MarkuprPlus

You see it. You say it. Your AI fixes it.

A Windows and macOS desktop app, CLI, and MCP server for visual feedback. Record and annotate from your desktop, process recordings from the terminal, or give your AI agent screen capture tools.

Download for Windows or macOS · Use the CLI · Connect an MCP client · GitHub Action

▶ Watch the 33-second product tour

Pick a window. Talk through what's wrong. Circle it while it happens. Every circle becomes its own issue, with its own screenshot, ready to paste into your coding agent.

Read from source at commit 00791b0bebbaOBSERVED · 2026-10-07
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add markuprplus -- npx -y [email protected]
03

Exposed tools (21)

17 read · 4 write · 0 destructive.

ToolRiskDescription
HTMLreadStandalone web page, no dependencies
JSONreadMachine-readable for integrations and APIs
MarkdownreadAI-ready format for Claude, ChatGPT, and other assistants
MarkuprPlusreadCreated from MarkuprPlus feedback session
PDFreadBeautiful document for sharing and printing
analyze_screenshotreadReturns the captured screen as image data with its MIME type so a vision-capable agent can inspect it directly.
analyze_videoreadReturns a structured report path plus transcript, extracted-frame, and processing counts for an existing video file.
capture_screenshotreadReturns a saved PNG path, markdown image reference, and captured cursor/window context for the current screen.
capture_with_voicereadReturns a structured report path plus transcript, extracted-frame, and processing counts from a timed screen-and-voice capture.
customreadA custom template
describe_screenreadReturns a structured visual description of a fresh screen capture or supplied image, including UI, text, layout, and notable issues.
github-issuereadGitHub-flavored Markdown optimized for issue bodies with task lists and collapsible details
jirareadJira wiki markup with panels, tables, and {code} blocks
jsonreadStructured JSON output for programmatic consumption
linearreadLinear-compatible Markdown for issue descriptions
markdownreadDefault Markdown format — AI-ready, llms.txt-inspired structured document
push_to_githubwriteReturns created GitHub issue URLs and numbers, or a dry-run preview, with one issue per report finding.
push_to_linearwriteReturns created Linear issue identifiers and URLs, or a dry-run preview, with one issue per report finding.
start_recordingwriteReturns a session ID and recording status for a new long-form screen-and-voice session.
stop_recordingwriteReturns the completed report path plus transcript, frame, and processing counts for the active recording session.
testreadv1
04

Trust audit

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (12 observation(s))
Network
declared (5 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
markuprx-action/action.yml:59
sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
markuprx-action/entrypoint.sh:49
sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
Why it matters. asks for elevated privileges
HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
.claude/commands/security.md:89
- Access API keys directly?
Why it matters. asks the agent to read credentials
MEDIUMInventory / provenance · inv.binary · CWE-1104
build/icon.icns
icon.icns
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
build/installer-header.bmp
installer-header.bmp
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
build/installer-sidebar.bmp
installer-sidebar.bmp
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
src/bridge/BridgeLaunchAgent.ts:114
const child = spawn('/bin/launchctl', args, {
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/main/ai/CodexCliDiscovery.ts:98
'/usr/local/bin/codex',
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/main/ai/providers/ClaudeCliDiscovery.ts:59
'/usr/local/bin/claude',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/integration/cliBridgeHttp.test.ts:139
const secret = 'sk-proj-abcdefghijklmnopqrstuvwxyz123456';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/unit/crashRecovery.test.ts:465
const apiKey = 'sk-proj-abcdefghijklmnopqrstuvwxyz1234567890';
MEDIUMPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
tests/unit/cliBridgeProtocol.test.ts:70
executable: '/usr/local/bin/codex',
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
tests/unit/cliBridgeServer.test.ts:36
executablePath: '/usr/local/bin/codex',
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
tests/unit/ipc/outputHandlers.test.ts:198
const result = await handlers.get(IPC_CHANNELS.OUTPUT_OPEN_FOLDER)!({}, '/etc/passwd');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/integrations/github/GitHubIssueCreator.ts:26
import type { FeedbackCategory, FeedbackSeverity } from '../../main/output/MarkdownGenerator';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/integrations/github/GitHubIssueCreator.ts:27
import { PUBLIC_BRAND_NAME, PUBLIC_WEBSITE_URL } from '../../shared/publicBrand';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/integrations/github/types.ts:7
import type { FeedbackCategory, FeedbackSeverity } from '../../main/output/MarkdownGenerator';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/integrations/github/types.ts:8
import { PUBLIC_BRAND_NAME } from '../../shared/publicBrand';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/integrations/linear/LinearIssueCreator.ts:20
import { PUBLIC_BRAND_NAME, PUBLIC_WEBSITE_URL } from '../../shared/publicBrand';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/superpowers/plans/2026-08-13-configurable-report-model-providers.md:16
- Ollama is fixed to `http://127.0.0.1:11434`; LM Studio is fixed to `http://127.0.0.1:1234`.
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/superpowers/plans/2026-08-13-configurable-report-model-providers.md:367
'http://127.0.0.1:11434/api/tags',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/superpowers/plans/2026-08-13-configurable-report-model-providers.md:376
'http://127.0.0.1:1234/v1/models',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/superpowers/plans/2026-08-30-markuprplus-cli-bridge.md:15
- Protocol version is `1`; the production endpoint is `http://127.0.0.1:49647`.
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/superpowers/specs/2026-08-13-configurable-report-model-providers-design.md:131
Probe only `http://127.0.0.1:11434`. Discover installed models from `GET /api/tags`; no arbitrary URL is accepted. The selected model is required. Where model metadata confirms vision support, the ada

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 00791b0bebbafull audit observations/trust-audit/mcp-server/hashfunction__markuprplus.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0700791b0bebbaBLOCKF40first audit
06

Questions

What is the MarkuprPlus MCP server?

Record your screen, narrate the bug, and hand your AI coding agent structured Markdown - one annotated screenshot per mark. Desktop app, CLI, and MCP server for Claude Code, Cursor, Codex, and Windsurf. On-device Whisper transcription, local-first, MIT.

What tools does MarkuprPlus expose?

21 in total: 17 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is MarkuprPlus safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (40/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does MarkuprPlus need?

It reads ANTHROPIC_API_KEY, APPLE_APP_SPECIFIC_PASSWORD, CSC_KEYCHAIN, GITHUB_TOKEN, LINEAR_API_KEY, MARKUPRX_E2E_FAIL_HOTKEY_PERSISTENCE_AFTER_REGISTRATION, MARKUPRX_E2E_FAIL_SETTINGS_KEY, MARKUPRX_E2E_INITIALIZE_HOTKEYS and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does MarkuprPlus run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as markuprx-landing at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (00791b0bebba), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement