registry / @papi-ai/server / 0.402.206
@papi-ai/server@0.402.206
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged command, credential, and configuration behaviors inspected have package-related purposes and are not evidence of exfiltration or unauthorized account action. Runtime telemetry is disclosed and can be disabled; the statusline writes Claude settings only when explicitly installed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Runtime telemetry requires an enabled setting, a PAPI data API key, and a configured endpoint; statusline setup requires the explicit --install argument.
Impact
The reviewed behavior reports usage metadata and displays PAPI status. The settings write occurs only on explicit installation.
Mechanism
Telemetry sends disclosed tool/event metadata to the PAPI data endpoint. The statusline reads the configured PAPI endpoint and bearer token to request /peek; its install option writes a statusLine entry to Claude settings.
AI rationale
The flagged command, credential, and configuration behaviors inspected have package-related purposes and are not evidence of exfiltration or unauthorized account action. Runtime telemetry is disclosed and can be disabled; the statusline writes Claude settings only when explicitly installed.
Evidence
~/.claude/settings.json/tmp/papi-statusline-<hash>.json
Network endpoints3
Configured PAPI data endpointConfigured PAPI endpoint /peekregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The README discloses runtime telemetry of tool name, duration, and project UUID, and documents an opt-out.
- Telemetry requires a PAPI data API key and sends tool/event metadata to the configured PAPI data endpoint.
- The statusline sends its bearer token to the `/peek` route on the endpoint resolved from user-supplied configuration.
- Writing the Claude settings file is behind the explicit `papi-statusline --install` command.
Evidence against
- The manifest has no lifecycle scripts; its main entry is the PAPI server.
- The inspected credential and configuration flows serve the package’s PAPI status display and setup behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggeddist/backfill-cycle-metrics.jsView file
1014});
L1015: import { execFileSync, spawnSync } from "child_process";
L1016: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L10143974init_git();
L3975: import { execFileSync as execFileSync2 } from "child_process";
L3976: function verifyUnboundReleaseWorkspace(projectId, repositoryUrl, workspacePath, proof = process.env["PAPI_WORKSPACE_RELEASE_TARGET"]) {
L3977: if (!proof) return false;
L3978: const target = JSON.parse(proof);
L3979: const expected = `https://github.com/${target.repository}`;
L3980: if (target.projectId !== projectId || !/^[\w.-]+\/[\w.-]+$/.test(target.repository ?? "") || !/^[a-f0-9]{40}$/.test(target.commit ?? "") || !repositoryUrl || normalizeGitUrl(reposi...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L3974dist/index.jsView file
Findings
3 Critical6 High4 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShelldist/index.js
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighCredential Redirect Persistencedist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
Affected versions and remediation
This report applies to @papi-ai/server@0.402.206.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.402.206 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.