Lightning MCP Server

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:09 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent Lightning-node MCP purpose, but it registers persistent assistant tooling through unpinned remote packages or broad Docker networking while handling sensitive node pairing data.

Review before installing. Prefer a locally audited build or pin the npm package to an exact version; if using Docker, use a fully qualified image pinned by digest and avoid host networking unless you have a specific local need. Use project scope instead of global scope when possible, review any .mcp.json or ~/.claude.json changes, keep LNC_INSECURE=false outside isolated development, and treat the LNC pairing phrase/password as secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:94

Finding

Unpinned npm Package Is Downloaded and Executed as an MCP Server

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:94-113
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

The documented installation commands register an npm package without an exact version or integrity constraint:

bash

# Zero-install via npx (downloads pre-built binary)
claude mcp add --transport stdio lnc -- npx -y @lightninglabs/lightning-mcp-server

# With environment variables for production
claude mcp add --transport stdio \
  --env LNC_MAILBOX_SERVER=mailbox.terminal.lightning.today:443 \
  lnc -- npx -y @lightninglabs/lightning-mcp-server

# For development/regtest
claude mcp add --transport stdio \
  --env LNC_MAILBOX_SERVER=localhost:11110 \
  --env LNC_DEV_MODE=true \
  --env LNC_INSECURE=true \
  lnc -- npx -y @lightninglabs/lightning-mcp-server

Technical Analysis

npx -y automatically downloads and executes the registry-selected version of @lightninglabs/lightning-mcp-server without prompting the user. No exact package version, lockfile, cryptographic integrity value, or signature verification is specified.

Consequently, the effective code executed by Claude can change after this Skill has been reviewed. A compromised npm publisher account, malicious package update, registry compromise, or compromised transitive dependency could introduce arbitrary code. Because this command is registered as an MCP server, it may be executed repeatedly in later Claude Code sessions rather than only during initial setup.

The package name uses a scoped namespace, which reduces ordinary dependency-confusion exposure, but it does not protect against publisher compromise, malicious releases, or unsafe transitive dependencies.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a dependency used by the package.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the docume ...[truncated 1168 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specific, audited version, for example:

   bash

   npx -y @lightninglabs/lightning-mcp-server@1.2.3
   

2. Use a committed lockfile and npm integrity metadata where installation is managed as part of a project.
3. Prefer distributing a signed release binary with published SHA-256 checksums.
4. Verify the binary checksum and release signature before adding it to the MCP configuration.
5. Avoid npx -y for security-sensitive software unless the artifact is pinned and independently verified.
6. Run the MCP process with minimal operating-system privileges and restrict its filesystem and network access.
7. Establish dependency scanning, reproducible builds, and release provenance such as SLSA attestations for the published artifact.

T08 · Insecure Dependencies

Error

• Location: scripts/setup-claude-config.sh:103

Finding

Unpinned Container Image Is Registered with Host Network Access

Content

View full analysis

Vulnerability Details

File Location: scripts/setup-claude-config.sh:103-116
Vulnerability Type: Mutable and unverified container dependency
Risk Level: High

The Docker-based configuration registers an image by an unqualified, mutable name and grants it host-network access:

bash

MCP_ENTRY=$(jq -n \
    --arg mailbox "$LNC_MAILBOX_SERVER" \
    --arg devmode "$LNC_DEV_MODE" \
    --arg insecure "$LNC_INSECURE" \
    '{
        command: "docker",
        args: ["run", "--rm", "-i", "--network", "host",
               "--env", "LNC_MAILBOX_SERVER",
               "--env", "LNC_DEV_MODE",
               "--env", "LNC_INSECURE",
               "lightning-mcp-server"],
        env: {
            LNC_MAILBOX_SERVER: $mailbox,
            LNC_DEV_MODE: $devmode,
            LNC_INSECURE: $insecure
        }
    }')

Technical Analysis

The image reference lightning-mcp-server contains no trusted registry namespace, immutable digest, or signature requirement. Container tags and implicit defaults are mutable, so the image eventually executed may differ from the image originally reviewed.

If the image is not already available locally, Docker may attempt to resolve it through the configured registry. This creates exposure to image-name ambiguity, namespace takeover, registry compromise, malicious tag replacement, or accidental use of an unrelated image.

The use of --network host gives the container direct access to the host network namespace on platforms that fully support this option. This is broader than the outbound WebSocket access described as necessary for the MCP server and can expose locally bound services that would otherwise be isolated from a normal container network.

Attack Path

1. An attacker publishes or replaces an image that resolves under the unqualified lightning-mcp-server name, or compromises the configured registry or image release process.
2. A user r ...[truncated 1416 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a fully qualified image reference from a controlled registry.
2. Pin the image by an immutable SHA-256 digest rather than a mutable tag:

   text

   registry.example.com/lightning/lightning-mcp-server@sha256:VERIFIED_DIGEST
   

3. Verify image signatures with an appropriate mechanism such as Cosign before registration or execution.
4. Publish and validate build provenance and a software bill of materials for the image.
5. Remove --network host unless a documented technical requirement makes it unavoidable. Use Docker's default isolated network with narrowly scoped outbound connectivity instead.
6. Apply container hardening options, including a non-root user, a read-only root filesystem, dropped Linux capabilities, no-new-privileges, resource limits, and a restrictive seccomp profile.
7. Fail safely when the expected verified image is unavailable rather than allowing Docker to resolve an ambiguous image name.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/configure.sh (reported line 96)May include surrounding context.

sh

echo ""

# Load .env to read mailbox config.
ENV_FILE="$MCP_SERVER_DIR/.env"
LNC_MAILBOX_SERVER="mailbox.terminal.lightning.today:443"
LNC_DEV_MODE="false"
LNC_INSECURE="false"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-claude-config.sh (reported line 77)May include surrounding context.

sh

echo ""

# Load .env to read mailbox config.
ENV_FILE="$MCP_SERVER_DIR/.env"
LNC_MAILBOX_SERVER="mailbox.terminal.lightning.today:443"
LNC_DEV_MODE="false"
LNC_INSECURE="false"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

# MCP LNC Server Configuration
# Copy this file to lightning-mcp-server/.env and customize for your environment.

# Default mailbox server address
# Production: mailbox.terminal.lightning.today:443

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/configure.sh (reported line 11)May include surrounding context.

sh

# MCP LNC Server Configuration
# Copy this file to lightning-mcp-server/.env and customize for your environment.

# Default mailbox server address
# Production: mailbox.terminal.lightning.today:443

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-claude-config.sh (reported line 76)May include surrounding context.

sh

# MCP LNC Server Configuration
# Copy this file to lightning-mcp-server/.env and customize for your environment.

# Default mailbox server address
# Production: mailbox.terminal.lightning.today:443

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · templates/env.txt (reported line 2)May include surrounding context.

text

# MCP LNC Server Configuration
# Copy this file to lightning-mcp-server/.env and customize for your environment.

# Default mailbox server address
# Production: mailbox.terminal.lightning.today:443

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run multiple shell scripts and external commands, but it does not declare a tool scope such as permissions or allowed-tools. That creates a trust boundary problem: an agent or user may not realize the skill requires shell execution, increasing the chance of unintended command execution during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation instructs users to provide a 10-word pairing phrase and password to connect to a node, but it does not prominently warn that these are sensitive credentials that must never be exposed in logs, transcripts, screenshots, or shared prompts. In an AI-assisted workflow, prompting users to paste secrets without explicit disclosure guidance materially increases the risk of credential leakage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Using npx -y @lightninglabs/lightning-mcp-server without a pinned version fetches and executes whatever package version is current at runtime. This introduces a supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could result in arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command again relies on npx to download and execute an unpinned package version. Because the package is executed directly as part of MCP server registration, any malicious upstream change would immediately affect the local environment.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The documented development configuration enables LNC_INSECURE=true, which disables TLS verification. Although presented for regtest/dev use, unsafe examples are often copied into broader use, enabling man-in-the-middle interception or server impersonation if reused outside a tightly controlled local environment.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

For development/regtest

claude mcp add --transport stdio
--env LNC_MAILBOX_SERVER=localhost:11110
--env LNC_DEV_MODE=true
--env LNC_INSECURE=true
lnc -- npx -y @lightninglabs/lightning-mcp-server

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The development example still executes an unpinned remote package through npx, so the same supply-chain execution risk applies even in non-production setups. Development environments are often less hardened, which can make compromise easier and later enable pivoting into other systems or projects.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/configure.sh (reported line 124)May include surrounding context.

sh

LNC_CONNECT_TIMEOUT=$TIMEOUT
EOF

chmod 600 "$ENV_FILE"

echo "Configuration written to $ENV_FILE (mode 0600)"
echo ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script unconditionally writes the updated Claude MCP configuration to either the project .mcp.json or the user's global ~/.claude.json without prompting, backup, or validation of user intent. While this appears administrative rather than malicious, modifying assistant configuration can silently change which external server Claude connects to and may overwrite or replace existing settings if the file contents are unexpected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.