registry / @papi-ai/server / 0.402.157
@papi-ai/server@0.402.157
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 20d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The flagged statusline write requires explicit installation, while setup, telemetry, and backfill behavior align with the package's stated server functions.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The server runs when launched; setup, backfill, and statusline installation require their respective commands.
Impact
No confirmed unauthorized credential disclosure, destructive action, or agent control hijack was established.
Mechanism
The inspected code performs PAPI setup and telemetry, project identity lookup, metric backfill, and optional statusline configuration.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior. The flagged statusline write requires explicit installation, while setup, telemetry, and backfill behavior align with the package's stated server functions.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hook; it declares ordinary build and runtime scripts.
- Setup contacts the PAPI service for a device code and stores the returned API key locally after approval.
- Telemetry sends tool and event metadata to the configured PAPI data endpoint only when enabled and configured.
- The statusline settings write requires an explicit install flag and leaves an existing status command untouched.
- The backfill command runs when directly invoked; its Git commands read user identity, and its runtime writes calculated cycle metrics.
- The flagged project-document paths are inputs to project file discovery, not instructions to the reviewer.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/backfill-cycle-metrics.jsView file
982});
L983: import { execFileSync, spawnSync } from "child_process";
L984: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L9823763init_git();
L3764: import { execFileSync as execFileSync2 } from "child_process";
L3765: function verifyUnboundReleaseWorkspace(projectId, repositoryUrl, workspacePath, proof = process.env["PAPI_WORKSPACE_RELEASE_TARGET"]) {
L3766: if (!proof) return false;
L3767: const target = JSON.parse(proof);
L3768: const expected = `https://github.com/${target.repository}`;
L3769: if (target.projectId !== projectId || !/^[\w.-]+\/[\w.-]+$/.test(target.repository ?? "") || !/^[a-f0-9]{40}$/.test(target.commit ?? "") || !repositoryUrl || normalizeGitUrl(reposi...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L3763dist/index.jsView file
Findings
2 Critical6 High4 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShelldist/index.js
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighCredential Redirect Persistencedist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @papi-ai/server@0.402.157.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.402.157 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.