@papi-ai/server@0.7.126
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports a warning for explicit agent configuration mutation, rather than a malware block. Scanner credential and configuration labels do not establish covert theft or install-time control hijacking.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling the MCP setup tool or running the status-line module with --install.
Impact
Persistent settings allow PAPI tools and cause commands to run during later agent use, including resolving a CLI release through npx.
Mechanism
Setup adds PAPI tool permission wildcards and a project command hook; status-line installation saves an npx command in user Claude settings.
AI rationale
Source supports a warning for explicit agent configuration mutation, rather than a malware block. Scanner credential and configuration labels do not establish covert theft or install-time control hijacking.
Evidence
dist/index.jsdist/statusline.js.claude/settings.json.claude/hooks/frontend-design-guard.sh
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no registry-install lifecycle hooks or runtime self-dependency.
- The MCP setup tool invokes project scaffolding that changes agent configuration.
- Setup allows all PAPI tools in Claude settings and registers an Edit/Write command hook.
- The status-line installer requires --install and configures a command that invokes @papi-ai/cli through npx.
- The flagged backfill location reads CLAUDE.md paths from Git history rather than changing agent instructions.
Evidence against
- No concrete malicious install behavior or covert credential theft was established.
- CLI authentication obtains a PAPI credential through browser-approved device authorization.
- The design hook checks for an active PAPI build and emits a warning without blocking edits.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/backfill-cycle-metrics.jsView file
271});
L272: import { execFileSync, spawnSync } from "child_process";
L273: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L271dist/index.jsView file
33204}
L33205: function powershellQuote(value) {
L33206: return `'${value.replace(/'/g, "''")}'`;
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
const hostedSupabaseUrl = cleanUrl(env.hostedSupabaseUrl);
dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/function...
import { mkdirSync, readFileSync as readFileSync2, writeFileSync, chmodSync } from "fs";
hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"]
"Authorization": `Bearer ${apiKey}`
"Authorization": `Bearer ${this.apiKey}`
`Auth: Invalid API key \u2014 PAPI_DATA_API_KEY was rejected by the proxy.
* Validate API key and project access against the proxy.
Findings
5 High4 Medium5 Low
HighChild Processdist/backfill-cycle-metrics.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @papi-ai/server@0.7.126.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.126 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.