registry / @papi-ai/server / 0.7.120
@papi-ai/server@0.7.120
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe reviewed source supports the package’s PAPI server and status-line functionality. Credential requests target configured PAPI endpoints, telemetry is limited to tool-event data, and the Claude settings write requires explicit invocation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Runtime telemetry and status-line requests occur when the server or status-line command is used; Claude settings changes require the explicit --install option.
Impact
No credential theft, unsolicited account action, or automatic agent-configuration modification was identified.
Mechanism
The inspected credential flows use PAPI-specific credentials with configured PAPI endpoints. Telemetry sends tool-event fields to the configured data endpoint.
AI rationale
The reviewed source supports the package’s PAPI server and status-line functionality. Credential requests target configured PAPI endpoints, telemetry is limited to tool-event data, and the Claude settings write requires explicit invocation.
Evidence
~/.claude/settings.jsontemporary PAPI status-line cache file
Network endpoints3
Configured PAPI endpoint /peekConfigured PAPI data endpoint /telemetryConfigured PAPI prompt endpoint
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall or postinstall hook; its main entry is dist/index.js.
- The status-line utility reads only PAPI bearer credentials from PAPI-specific flags, environment variables or a PAPI MCP entry, then sends them to that configured endpoint’s /peek route.
- Writing Claude settings requires the explicit --install argument, and the installer preserves an existing statusLine entry.
- Telemetry is opt-out and sends tool name, event type, optional project ID and event metadata to the configured PAPI data endpoint.
- Prompt credentials are read from PAPI_PROMPT_API_KEY and sent to the explicitly configured PAPI_PROMPT_ENDPOINT.
Evidence against
- The main entry contains commands that read the local Git email and query gh for an email address; the inspected code does not show those values being sent to an unrelated host.
- The separate status-line code can write ~/.claude/settings.json when explicitly invoked with --install.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
271});
L272: import { execFileSync, spawnSync } from "child_process";
L273: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L271dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @papi-ai/server@0.7.106
matchedIdentity = npm:QHBhcGktYWkvc2VydmVy:0.7.106
similarity = 0.400
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg32839}
L32840: function powershellQuote(value) {
L32841: return `'${value.replace(/'/g, "''")}'`;
High
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @papi-ai/server@0.7.120.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.120 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.