Secure MCP bridge enabling Claude on your phone to browse and edit local repos with real-time, human-approved file access and audit logging.

This package implements an approval-gated local file bridge, but the implementation relies on 'local-only' assumptions that are fragile when you follow the SKILL.md advice to use tunnels (Tailscale / Cloudflare). Key issues to consider before installing or exposing this: - Unauthenticated endpoints: The WebSocket (/ws/approvals) and the user-facing approval decision endpoints do not enforce the bearer token in the provided code. If the HTTP server or MCP SSE is reachable from the network (e.g., via a tunnel), an attacker could connect, create approval requests, and also call the decision endpoints to grant themselves access. - MCP SSE authentication: The MCP tools are mounted and appear callable without going through FastAPI's bearer-token dependency. That means clients able to hit /mcp/sse may trigger file-access requests. The approval gating only protects access if the approver is truly local and the decision endpoints remain inaccessible remotely. - CORS / origin assumptions: The app sets allow_origins=["*"], which makes browser-based CSRF or cross-origin abuse easier if the service is reachable externally. The dashboard also stores tokens in localStorage which could be abused on a compromised client. Recommended actions to make this safer: - Do not expose the service to the public internet unless you harden it first. Keep it bound to 127.0.0.1 and use an authenticated tunnel that enforces access control. - Add server-side token checks for the WebSocket (validate the token on connect) and require authentication on approval decision endpoints (or restrict them to localhost via middleware). Ensure the MCP SSE layer requires the same bearer token or another authenticated channel. - Narrow CORS to only trusted origins (or remove it if not needed). - Consider per-request CSRF protections for browser-driven actions and avoid storing long-lived secrets in localStorage. - Review requirements.txt and run the code locally in a sandbox before using tunnels; confirm the token printed at startup and the dashboard token match and that all entrypoints validate it. Given these concrete mismatches between claimed protections and the code, treat this skill as suspicious until you or the author apply the hardening steps above or confirm an updated release that enforces auth on all external entry points.

Type: OpenClaw Skill Name: claude-local-bridge Version: 0.1.0 The OpenClaw AgentSkills skill bundle is designed with strong security principles like sandboxing, explicit human approval for file access, and bearer token authentication for core file operations. However, it contains a critical vulnerability: the `/ws/approvals` WebSocket endpoint (in `app/routers/ws.py`) is not authenticated, allowing an attacker to bypass the human approval mechanism and approve/deny file access requests if the server is exposed publicly. Additionally, the FastAPI app uses `allow_origins=["*"]` for CORS, which is a vulnerability if deployed publicly without hardening. These flaws, while not indicative of intentional malice, represent significant security risks that could be exploited.