Security review

Koga Lens is intentionally narrow: one parameter-free read tool, one user-approved window, explicit states, and a latest-frame-only response.

The approval step is load-bearing

The user selects a window through the Windows Graphics Capture picker. Claude cannot choose a file, window handle, process, path, or replacement source. Switching windows requires new OS approval. A future “Switch window” shortcut could reduce clicks, but it must not remove that consent step.

Tool boundary

GetCurrentView accepts no parameters. Its verified response fields are:

Field	Purpose
`status`	Current sharing or failure state.
`windowTitle`	Title of the user-approved source.
`sessionId`	Identity for the current sharing session.
`capturedAt`	ISO 8601 UTC capture time.
`frameSha256`	Hash of the returned frame bytes.
`width`, `height`	Returned image dimensions.
Image	The current frame, when the state permits it.

Image byte size is not part of the response payload. It appears only in the audit log and diagnostic panel.

Freshness and state handling

STOPPEDSharing has not been activated.

SOURCE_LOSTThe connection dropped; the user must reselect a window.

FRAME_STALEThe frame exceeds the two-second maximum age; no image is returned.

Paused / new SharePrior preview state is cleared so an old image is not shown as current.

Returned-byte provenance

The “Last frame returned to AI” panel is decoded from the exact base64 string placed in the MCP image content block—not from a separate capture. It shows the decoded-byte SHA-256, timestamps, session, window title, byte length, and dimensions. A MATCH/MISMATCH indicator compares the preview bytes, audit entry, and MCP response metadata.

The user may save those exact decoded JPEG bytes to a chosen path. Saving never happens automatically, and the control is unavailable when no frame exists.

Prompt-injection posture

Any shared window is an injection surface. Text visible in a captured frame must be treated as observed content, not as user instructions.

During live verification, Claude treated shell-like content in a dense document as text to transcribe, not execute. It also declined to trigger capture from instructions supplied as a pasted URL fragment and as a screenshot, then ran the tool only after the user typed the request directly. These are observed behaviors, not a claim that model interpretation can never fail.

Privacy and network boundary

Koga Lens has no cloud relay, telemetry, or upload of its own. Its latest frame is transient and held in memory. Once Koga Lens returns a frame to Claude Desktop, that image is handled by Claude Desktop and Anthropic under Anthropic’s terms; Koga Lens does not control that downstream hop.

How to diagnose a future misread

Panel correct, hashes MATCH, Claude wrong: interpretation failure; investigate capture resolution, JPEG quality, DPI, or visible text size.
Panel shows wrong pixels: capture or frame-selection failure; save exact bytes to preserve evidence.
Hashes MISMATCH: encoding-chain failure; the diagnostic comparison identifies the failing hop.