registry / Telemetry / @papi-ai/server

@papi-ai/server

PAPI MCP server: a shared plan, decisions and review history that any MCP-compatible AI client picks up where the last session left off

This report shows the evidence for @papi-ai/server@0.402.208. 0 of 26 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The flagged credential and command findings were not supported: the status-line uses PAPI-specific credentials with the configured endpoint, and its settings write requires an explicit install flag. However, runtime telemetry is enabled by default, can be disabled, and was not disclosed in the README, making this suspicious under the telemetry rule.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Tool calls or error events during server runtime, when a PAPI data API key and telemetry endpoint are configured.

Impact

Usage and project-associated metadata are reported to the PAPI data service without an evident package-level disclosure.

Mechanism

The server posts tool names, event types, metadata and an optional project ID to the configured endpoint’s /telemetry route; PAPI_TELEMETRY can disable it.

AI rationale

Evidence

dist/index.js

Network endpoints1

Configured PAPI data endpoint: /telemetry

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Runtime telemetry is enabled by default and can be disabled with PAPI_TELEMETRY=false or off.
Telemetry sends tool names, event types, metadata and an optional project ID to the configured PAPI data endpoint using PAPI_DATA_API_KEY; the README search found no telemetry disclosure.

Evidence against

The package’s main entry is dist/index.js; the status-line command is a separate bin entry.
The status-line sends a PAPI bearer token to the endpoint configured in PAPI-specific settings and only writes Claude settings when invoked with --install.
The main server’s detected user identity comes from Git or GitHub CLI and is used in project resolution against the configured database adapter.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

10 flagged

dist/backfill-cycle-metrics.jsView file

1014}); L1015: import { execFileSync, spawnSync } from "child_process"; L1016: function isGitAvailable() {

High

Child Process

Package source references child process execution.

dist/backfill-cycle-metrics.jsView on unpkg · L1014

3974init_git(); L3975: import { execFileSync as execFileSync2 } from "child_process"; L3976: function verifyUnboundReleaseWorkspace(projectId, repositoryUrl, workspacePath, proof = process.env["PAPI_WORKSPACE_RELEASE_TARGET"]) { L3977: if (!proof) return false; L3978: const target = JSON.parse(proof); L3979: const expected = `https://github.com/${target.repository}`; L3980: if (target.projectId !== projectId || !/^[\w.-]+\/[\w.-]+$/.test(target.repository ?? "") || !/^[a-f0-9]{40}$/.test(target.commit ?? "") || !repositoryUrl || normalizeGitUrl(reposi...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/backfill-cycle-metrics.jsView on unpkg · L3974

dist/index.jsView file

Findings

2 Critical6 High4 Medium5 Low

CriticalCommand Output Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/backfill-cycle-metrics.js

HighShelldist/index.js

HighSame File Env Network Executiondist/backfill-cycle-metrics.js

HighCredential Redirect Persistencedist/index.js

HighExternal Ai Agent Control Surface Mutationdist/statusline.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @papi-ai/server@0.402.208.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @papi-ai/server@0.402.208 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 20:32:36.803Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

26 known versions

0.402.208latestshownSuspiciousTelemetryWarnPublishedOct 30, 2026, 8:28 PM 0.402.206Clean—AllowPublishedOct 30, 2026, 3:05 PM 0.402.157Clean—AllowPublishedOct 15, 2026, 7:18 PM 0.402.35SuspiciousAI-agent capability abuseWarnPublishedSep 22, 2026, 11:26 PM

registry / Telemetry / @papi-ai/server

@papi-ai/server

PAPI MCP server: a shared plan, decisions and review history that any MCP-compatible AI client picks up where the last session left off

This report shows the evidence for @papi-ai/server@0.402.208. 0 of 26 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Tool calls or error events during server runtime, when a PAPI data API key and telemetry endpoint are configured.

Impact

Usage and project-associated metadata are reported to the PAPI data service without an evident package-level disclosure.

Mechanism

The server posts tool names, event types, metadata and an optional project ID to the configured endpoint’s /telemetry route; PAPI_TELEMETRY can disable it.

AI rationale

Evidence

dist/index.js

Network endpoints1

Configured PAPI data endpoint: /telemetry

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Runtime telemetry is enabled by default and can be disabled with PAPI_TELEMETRY=false or off.
Telemetry sends tool names, event types, metadata and an optional project ID to the configured PAPI data endpoint using PAPI_DATA_API_KEY; the README search found no telemetry disclosure.

Evidence against

The package’s main entry is dist/index.js; the status-line command is a separate bin entry.
The status-line sends a PAPI bearer token to the endpoint configured in PAPI-specific settings and only writes Claude settings when invoked with --install.
The main server’s detected user identity comes from Git or GitHub CLI and is used in project resolution against the configured database adapter.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

10 flagged

dist/backfill-cycle-metrics.jsView file

1014}); L1015: import { execFileSync, spawnSync } from "child_process"; L1016: function isGitAvailable() {

High

Child Process

Package source references child process execution.

dist/backfill-cycle-metrics.jsView on unpkg · L1014

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/backfill-cycle-metrics.jsView on unpkg · L3974

dist/index.jsView file

Findings

2 Critical6 High4 Medium5 Low

CriticalCommand Output Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/backfill-cycle-metrics.js

HighShelldist/index.js

HighSame File Env Network Executiondist/backfill-cycle-metrics.js

HighCredential Redirect Persistencedist/index.js

HighExternal Ai Agent Control Surface Mutationdist/statusline.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @papi-ai/server@0.402.208.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @papi-ai/server@0.402.208 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 20:32:36.803Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

26 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Runtime surface

Behavioral surface