@localstack/localstack-mcp-server
A LocalStack MCP Server for managing LocalStack containers with Pro support
9
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
skyrpexsilv-ioluca.localstackjoe4devdominikschubertstefanie_localstackanisa_oshaficarole-lavillonniereharshcasperwhummerbentsku
Keywords
localstackawslocal-developmentlocal-testing
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/999.js | AI (source-diff): dist/999.js is a webpack chunk from xmcp build containing posthog-node/Sentry; standard minified bundle output for this package. | ai | |
| source-diff | net-exec-file:dist/999.js | AI (source-diff): Network calls in bundle are posthog analytics and Sentry error reporting; no dynamic code execution beyond normal bundled deps. | ai | |
| source-diff | net-exec-file:dist/44.js | AI (source-diff): Network calls are to LocalStack endpoints; dynamic execution is webpack module system boilerplate. | ai | |
| source-diff | obfuscated-file:dist/466.js | AI (source-diff): Standard webpack chunk output from xmcp build; content is LocalStack config/client logic. | ai | |
| source-diff | obfuscated-file:dist/44.js | AI (source-diff): Standard webpack chunk output from xmcp build; content is LocalStack tool logic, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/780.js | AI (source-diff): Same webpack chunk pattern; legitimate build artifact. | ai | |
| source-diff | obfuscated-file:dist/184.js | AI (source-diff): Standard webpack/xmcp build chunk; numeric chunk IDs and LocalStack config constants confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/235.js | AI (source-diff): Same webpack chunk pattern as dist/184.js; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/956.js | AI (source-diff): Same webpack chunk pattern; legitimate build artifact. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Declared runtime dep used via xmcp build toolchain; phantom detection is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:posthog-node | AI (phantom-deps): Declared runtime dep for telemetry; phantom detection is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:dockerode | AI (phantom-deps): Declared runtime dep for Docker management; phantom detection is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:xmcp | AI (phantom-deps): xmcp is the build framework; invoked via scripts, not direct import — stable false positive. | ai |