LMCP security overview
For CISOs, BISOs and InfoSec teams: how LMCP runs, what leaves the computer and when, and what IT can turn off. Where a control does not exist, this page says so.
Architecture
LMCP is a server that runs on each computer. Desktop AI clients such as Claude Desktop, Cursor and VS Code start it and talk to it over local stdio: those calls do not go through our servers.
Web AIs and the Cloud Relay
A web AI such as ChatGPT or Claude.ai cannot reach a process on the computer, so its calls go through the LMCP Cloud Relay: a WebSocket the computer opens to our server over TLS. The relay carries each request and its result. It is not end-to-end encrypted: our server reads the call to route it.
For each relayed call the server stores metadata, not the request or result: the tool name, the method, which AI client made it, sizes, status, latency and an error message when the call fails. These rows are deleted after 60 days. It also keeps a count of relayed calls per computer per day.
Who turns the relay on
Each person turns the relay on or off from the LMCP menu. On Mac it is on unless the person turned it off; on Windows it stays off until the person turns it on. The organization policy has no key for the relay today. Tools removed with disabled_tools are also hidden from web AIs.
What leaves the computer, and when
- Usage telemetry, regularly: versions, operating system, resource use, which services and AI clients are set up, and the names of the tools called with call and error counts. Not the content of mail, files or messages.
- A problem report, only when the person asks for one: LMCP shows a preview first and sends it only after a second confirmation.
- The check for a new version, every 30 minutes.
- Calls from web AIs, through the relay, while it is on.
Turning those off
The organization policy has no key for telemetry, the relay or update checks. Usage telemetry stops with the environment variable LMCP_DISABLE_TELEMETRY=1; a minimal heartbeat with the machine identifier and versions is still sent. A tool turned off with disabled_tools cannot be called by any AI client.
Credentials
- Mac: connector credentials and the Microsoft 365 tokens are kept in the macOS Keychain; a Microsoft 365 token written by a process other than the menu-bar app can stay in the configuration file in the person’s profile. Notion, Slack and Google Drive read the data of their own desktop apps and store no token.
- Windows: the relay token, Todoist, Telegram and mail passwords are kept in Windows Credential Manager. The Microsoft 365 tokens are kept in a file in the person’s profile that only that person can read.
- The WhatsApp session is kept in a local store in the person’s profile, on both.
Local audit log
Every tool call is written to a log on the computer with the time, the tool and whether it succeeded. The person or an AI client reads it with get_audit_log. It stays on the computer.
Confirmation before acting
Calls that leave the computer or cannot be undone, such as sending an email, posting to Teams or WhatsApp, deleting a file for good or running a terminal command, first show a preview and run only when confirmed. This is enforced where every call is dispatched, on Mac and on Windows.
What IT can block
Through the policy (how to place it): read-only mode, tools with disabled_tools, whole services with disabled_services or an allow-list, and per-account permissions.
A service IT turns off disappears at once, and its connected account is removed, with no opt-in, once the policy has been at rest for 60 seconds; each policy source is judged on its own, and the person sees a notice first. Turning off WhatsApp also deletes the cached chats of every WhatsApp account on the computer.
What we do not have
LMCP has no SOC 2 report and no ISO 27001 certification. For your security questionnaire, write to us.
Not available yet
An enrollment console that sends the policy to each machine is not deployed: today the policy is placed by MDM or the registry.