@papi-ai/server@0.402.208
PAPI MCP server: a shared plan, decisions and review history that any MCP-compatible AI client picks up where the last session left off
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged credential and command findings were not supported: the status-line uses PAPI-specific credentials with the configured endpoint, and its settings write requires an explicit install flag. However, runtime telemetry is enabled by default, can be disabled, and was not disclosed in the README, making this suspicious under the telemetry rule.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Tool calls or error events during server runtime, when a PAPI data API key and telemetry endpoint are configured.
Impact
Usage and project-associated metadata are reported to the PAPI data service without an evident package-level disclosure.
Mechanism
The server posts tool names, event types, metadata and an optional project ID to the configured endpoint’s /telemetry route; PAPI_TELEMETRY can disable it.
AI rationale
The flagged credential and command findings were not supported: the status-line uses PAPI-specific credentials with the configured endpoint, and its settings write requires an explicit install flag. However, runtime telemetry is enabled by default, can be disabled, and was not disclosed in the README, making this suspicious under the telemetry rule.
Evidence
dist/index.js
Network endpoints1
Configured PAPI data endpoint: /telemetry
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry is enabled by default and can be disabled with PAPI_TELEMETRY=false or off.
- Telemetry sends tool names, event types, metadata and an optional project ID to the configured PAPI data endpoint using PAPI_DATA_API_KEY; the README search found no telemetry disclosure.
Evidence against
- The package’s main entry is dist/index.js; the status-line command is a separate bin entry.
- The status-line sends a PAPI bearer token to the endpoint configured in PAPI-specific settings and only writes Claude settings when invoked with --install.
- The main server’s detected user identity comes from Git or GitHub CLI and is used in project resolution against the configured database adapter.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/backfill-cycle-metrics.jsView file
1014});
L1015: import { execFileSync, spawnSync } from "child_process";
L1016: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L10143974init_git();
L3975: import { execFileSync as execFileSync2 } from "child_process";
L3976: function verifyUnboundReleaseWorkspace(projectId, repositoryUrl, workspacePath, proof = process.env["PAPI_WORKSPACE_RELEASE_TARGET"]) {
L3977: if (!proof) return false;
L3978: const target = JSON.parse(proof);
L3979: const expected = `https://github.com/${target.repository}`;
L3980: if (target.projectId !== projectId || !/^[\w.-]+\/[\w.-]+$/.test(target.repository ?? "") || !/^[a-f0-9]{40}$/.test(target.commit ?? "") || !repositoryUrl || normalizeGitUrl(reposi...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L3974dist/index.jsView file
Findings
2 Critical6 High4 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShelldist/index.js
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighCredential Redirect Persistencedist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @papi-ai/server@0.402.208.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.402.208 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.