registry / @papi-ai/server / 0.7.113
@papi-ai/server@0.7.113
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe reviewed credential flow sends a PAPI-specific key only to an endpoint explicitly configured for prompt retrieval, and otherwise uses bundled prompts. The flagged settings changes are part of explicit setup or status-line installation; no malicious install-time or automatic credential redirection was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Server startup uses its configured backend; project setup and status-line installation require their respective user-invoked commands.
Impact
No malicious behavior was found. Setup can create project scaffolding and register a project hook, and status-line installation can update the user's Claude settings.
Mechanism
The server uses configured PAPI credentials with its configured service endpoints. The status-line command reads PAPI configuration and caches response data; its settings write is behind --install.
AI rationale
The reviewed credential flow sends a PAPI-specific key only to an endpoint explicitly configured for prompt retrieval, and otherwise uses bundled prompts. The flagged settings changes are part of explicit setup or status-line installation; no malicious install-time or automatic credential redirection was found.
Evidence
.claude/settings.json~/.claude/settings.jsonOS temporary directory: papi-statusline-*.json
Network endpoints2
getpapi.airegistry.npmjs.org/@papi-ai/server/latest
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/index.js as the server entry and declares no install lifecycle hook.
- Prompt fetching falls back to bundled prompts unless PAPI_PROMPT_ENDPOINT is configured; any PAPI_PROMPT_API_KEY is sent to that configured endpoint.
- The CLI handles setup as an explicit subcommand; project scaffold and Claude settings changes occur as part of setup.
- The separate status-line installer writes Claude settings only when run with --install; otherwise it reads PAPI-specific configuration and fetches from its configured endpoint.
Evidence against
- The server can run git and GitHub CLI commands to detect the user's email for project ownership.
- Setup and status-line installation can write AI-client settings and hooks, though these actions are tied to their respective user-invoked setup/install flows.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggeddist/backfill-cycle-metrics.jsView file
271});
L272: import { execFileSync, spawnSync } from "child_process";
L273: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L271dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @papi-ai/server@0.7.106
matchedIdentity = npm:QHBhcGktYWkvc2VydmVy:0.7.106
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
const hostedSupabaseUrl = cleanUrl(env.hostedSupabaseUrl);
dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/function...
import { mkdirSync, readFileSync as readFileSync2, writeFileSync, chmodSync } from "fs";
hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"]
"Authorization": `Bearer ${apiKey}`
"Authorization": `Bearer ${this.apiKey}`
`Auth: Invalid API key \u2014 PAPI_DATA_API_KEY was rejected by the proxy.
* Validate API key and project access against the proxy.
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @papi-ai/server@0.7.113.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.113 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.