MCP server for Apple Photos - query, search, export, and inspect the macOS Photos library via Claude and other AI assistants, plus opt-in album/metadata write tools (read-only by default)
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution in sweetrb/apple-photos-mcp
- HIGH code analysis flagged dynamic code execution in sweetrb/apple-photos-mcp
- HIGH code analysis flagged dynamic code execution in sweetrb/apple-photos-mcp
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 1ab30ee · analyzer v28 · 2d ago
skills & prompt files 4
danger signals1
- dynamic code execution new Function() sweetrb-apple-photos-mcp-1ab30ee/build/index.js :2947
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 46
filesystem 8
- fs sweetrb-apple-photos-mcp-1ab30ee/build/index.js :21358
import { readFileSync as readFileSync3 } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/index.ts :5
import { readFileSync } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/services/fileConfig.ts :17
import { existsSync, readFileSync } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/services/photosManager.ts :1
import { existsSync, statSync } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/tools/doctor.ts :14
import { existsSync } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/utils/exportPath.ts :12
import { existsSync, realpathSync } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/utils/python.ts :3
import { existsSync, readFileSync } from "node:fs"; - fs sweetrb-apple-photos-mcp-1ab30ee/src/utils/setupLock.ts :23
import { mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
shell / exec 3
- shell sweetrb-apple-photos-mcp-1ab30ee/build/index.js :7845
var _emojiRegex = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`; - shell sweetrb-apple-photos-mcp-1ab30ee/src/utils/python.ts :1
import { execSync, execFile } from "node:child_process"; - shell sweetrb-apple-photos-mcp-1ab30ee/src/utils/sidecarClient.ts :42
import { spawn as nodeSpawn } from "node:child_process";
install hooks 3
- prepublishOnly sweetrb-apple-photos-mcp-1ab30ee/package.json :37
pnpm run lint && pnpm test && pnpm run build - preinstall (suspicious) sweetrb-apple-photos-mcp-1ab30ee/package.json :38
node -e "const fs=require('fs');const ua=process.env.npm_config_user_agent||'';if(fs.existsSync('.git')&&!ua.startsWith('pnpm')){console.error('\nThis repo uses pnpm. npm/yarn resolve dependencies off - prepare sweetrb-apple-photos-mcp-1ab30ee/package.json :39
husky; pnpm run build
declared dependencies 16
- @modelcontextprotocol/sdk@^1.29.0
- zod@^3.22.4
- @eslint/js@^9.0.0
- @types/node@^22.0.0
- @typescript-eslint/eslint-plugin@^8.57.2
- @typescript-eslint/parser@^8.57.2
- @vitest/coverage-v8@^3.2.6
- esbuild@^0.28.1
- eslint@^9.0.0
- globals@^17.0.0
- husky@^9.0.0
- lint-staged@^16.2.7
- prettier@^3.0.0
- typescript@^5.5.0
- typescript-eslint@^8.51.0
- vitest@^3.2.6