OmerLapidot/lg-tv-mcp

Review signals: 1 connection review, 42 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. <internal-ip>:3001 9 attributed processes.

OSV reports a known vulnerability in this dependency version. 10 distinct locations. 42 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• get_status works without pairing and reports the TV state: Real input produced the expected result: LG 65NANO80VNA

  Source: `get_status` works unpaired.

  Input: {"tool": "get_status", "arguments": {}}

  Expected: JSON status containing the constant model string

  Command: node <guest-path> tools/call {"tool": "get_status", "arguments": {}}

  Observed: LG 65NANO80VNA\",\"ip\":\"<internal-ip>\",\"hostname\":\"LGwebOSTV.local\"},\"hint\":\"הטלוויזיה כבויה או לא נגישה ברשת. אפשר להדליק אותה עם power_on ולנסות שוב.\"}"}], "structuredContent": {"power": "off", "paired": false, "tv": {"model": "LG 65NANO80VNA", "ip": "<internal-ip>", "hostname": "LGwebOSTV.local"}, "hint": "הטלוויזיה כבויה או לא נגישה ברשת. אפשר להדליק אותה עם power_on ולנסות שוב."}}

Examples

• Run the full offline test suite against the in-process fake TV: command completed successfully

  Source: README.md Development section

  Input: npm test

  Expected: all tests pass

  Command: npm test

  Observed: 4.308562 type: 'test' ... # Subtest: magicPacket is 6xFF then 16 repetitions of the MAC ok 80 - magicPacket is 6xFF then 16 repetitions of the MAC --- duration_ms: 0.88379 type: 'test' ... # Subtest: magicPacket rejects malformed MACs ok 81 - magicPacket rejects malformed MACs --- duration_ms: 0.639809 type: 'test' ... # Subtest: sendWakeOnLan emits the packet over UDP ok 82 - sendWakeOnLan emits the packet over UDP --- duration_ms: 10.292091 type: 'test' ... 1..82 # tests 82 # suites 0 # pass 82 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 31557.863539

Local or hosted: local

Run the lg-tv-mcp stdio MCP server (node server/index.js) and call the get_status tool; run the documented npm test suite

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -c 6000
curl -sS -m 10 http://<internal-ip>:9226/json/version; echo "exit=$?"; echo "CDP_URL=$CDP_URL"; ls <guest-path> ; ls /inputs 2>/dev/null
cd <guest-path> && tail -c 1400 README.md; echo; echo ---; node --version 2>&1; npm --version 2>&1; cat package.json; ls server test scripts; cat .mcp.json
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm ci 2>&1 | tail -n 20; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && timeout 280 npm test 2>&1 | tail -n 25; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat server/index.js | head -c 1500; echo; echo ---; cat server/config.js | head -c 2000; echo; echo ---; cat server/pairing.json | head -c 300; echo; cat .gitignore; ls .coldpass
mkdir -p <guest-path> && cd <guest-path> && cat > call.mjs <<'EOF'
import { Client } from '<guest-path>';
import { StdioClientTransport } from '<guest-path>';
const [tool, args] = [process.argv[2], JSON.parse(process.argv[3] || '{}')];
const t = new StdioClientTransport({ command: 'node', args: ['<guest-path>'], cwd: '<guest-path>', env: { ...process.env, LG_TV_DATA_DIR: '<guest-path>' } });
const c = new Client({ name: 'probe', version: '0' });
await c.connect(t);
const tools = await c.listTools();
console.log('TOOLS:', tools.tools.map(x => x.name).join(','));
const r = await c.callTool({ name: tool, arguments: args });
console.log(JSON.stringify(r));
await c.close();
EOF
timeout 60 node call.mjs get_status '{}' 2>&1 | head -c 3000; echo "exit=$?"
cd <guest-path> && grep -rn "setInterval\|cron\|setTimeout\|--once\|--now\|webhook" server/ scripts/ | head -n 20; echo "---"; ls -la .coldpass; ls -la <guest-path>; ls /inputs 2>&1 | head -3
cd <guest-path> && mkdir -p <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["node","<guest-path>"],"cwd":"<guest-path>","env":{"LG_TV_DATA_DIR":"<guest-path>"},"tool":"get_status","arguments":{},"expected_text":"LG 65NANO80VNA"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"get_status works without pairing and reports the TV state","source":"README.md","input":"get_status with no arguments on a fresh data directory","expected":"JSON status containing the constant model string","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"get_status","arguments":{},"expected_text":"LG 65NANO80VNA","env":{"LG_TV_DATA_DIR":"<guest-path>"},"cwd":"<guest-path>"}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Run the full offline test suite against the in-process fake TV","source":"README.md Development section","input":"npm test","expected":"all tests pass","argv":["npm","test"],"cwd":"<guest-path>","env":{},"expected_text":"# fail 0"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (server/index.js, server/server.js, package.json scripts). The product is a request-driven stdio MCP server with no cron, scheduler, --once/--now flag, or webhook loop. The only setTimeout calls are internal request timers (SSAP timeouts, a 2s wait after power-on, 150ms between repeated button presses, mic capture timeout). Repeating actions such as the sound-meter loop are driven by the MCP client calling tools, not by the product.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in ["probe.json","claims.json","examples.json","cycles.json"]];print("json ok")'
cd <guest-path> && <env-var>=<guest-path> timeout 600 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && grep -c 'get_status` works unpaired.' README.md && python3 -I - <<'EOF'
import json
p='<guest-path>'
c=json.load(open(p))
c[0]['source']='`get_status` works unpaired.'
json.dump(c,open(p,'w'),ensure_ascii=False,indent=1)
print('updated')
EOF
<env-var>=<guest-path> timeout 600 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && <env-var>=<guest-path> timeout 600 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c 'import json,sys
t=open("<guest-path>").read()
i=t.find("{")
d=json.loads(t[i:])
print("valid=",d.get("valid")); print("problems=",d.get("problems"))' 2>&1 | head -c 1500
pgrep -af "server/index.js" || echo "no server processes left"; cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the lg-tv-mcp stdio MCP server (node server/index.js) and call the get_status tool; run the documented npm test suite","operation_scope":"Node.js 22.23.4 and npm 10.9.9 on Linux; no LG TV on the network, so only unpaired, no-side-effect status was exercised against a real tool call. Browser not needed (shared CDP endpoint reachable, HTTP 200, but unused by this product).","steps":["npm ci (README Install)","npm test (README Development): 82 of 82 tests pass","node <guest-path> as stdio MCP server, tools/call get_status with LG_TV_DATA_DIR set to a fresh directory: returns power off, paired false, model LG 65NANO80VNA"],"deviations":["Used a scratch Node MCP client outside the workspace (<guest-path>) to observe get_status before writing the probe; the probe itself is run by the checker.","Initial claim source was a filename instead of an exact README quote; corrected to the line '`get_status` works unpaired.' and re-validated.","/inputs/coldpass-preflight.py does not exist in this VM; used <guest-path> as instructed in the task.","Workspace is not a git checkout; no git init/fetch was needed because npm ci and the tests ran directly from the provided source.","npm ci reported 10 audit vulnerabilities (1 critical, 6 high); not addressed, out of scope."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the exercised path. For full hardware validation, run on a LAN with an LG webOS TV, set mac in config.json for Wake-on-LAN, and pair with the TV remote."}
EOF
python3 -I -c 'import json;json.load(open("<guest-path>"));print("report ok")'; ls -la <guest-path> <guest-path> | head -n 30
cd <guest-path> && ls -la && python3 -I -c 'import json;print(json.load(open("probe.json"))["tool"], json.load(open("report.json"))["outcome"])'
cd <guest-path> && <env-var>=<guest-path> timeout 600 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c 'import json
t=open("<guest-path>").read()
d=json.loads(t[t.find("{"):])
print("valid=",d.get("valid"),"problems=",d.get("problems"))'