@google/chrome-enterprise-premium-mcp
Chrome Enterprise Premium MCP server
12
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
google-wombotofrobotsmrdoob
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:silent-process-exec | AI (semgrep): Detached spawn used to open browser for OAuth flow; not a reverse shell or miner. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same OAuth browser-open pattern; stable false positive for this package. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP is 127.0.0.1 loopback for OAuth redirect server; legitimate and expected. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into a child process spawn is standard for MCP server launchers; not exfiltration. | ai | |
| phantom-deps | phantom-dep:@google-cloud/service-usage | AI (phantom-deps): Framework-scoped dependency loaded by convention; stable false positive for this package. | ai |