@papi-ai/server@0.7.41
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection contradicts the scanner’s install-time/exfiltration interpretation, but confirms explicit agent-extension setup and telemetry. This warrants warning rather than a malicious block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User or MCP-client invocation of init/setup; runtime tool calls with PAPI telemetry enabled.
Impact
Adds a PAPI MCP server/permission or hook to selected agent configuration; sends configured usage metadata.
Mechanism
explicit agent-config mutation, project-local hook registration, and telemetry POSTs
AI rationale
Source inspection contradicts the scanner’s install-time/exfiltration interpretation, but confirms explicit agent-extension setup and telemetry. This warrants warning rather than a malicious block.
Evidence
package.jsondist/index.jsREADME.md.mcp.json.claude/settings.json.claude/hooks/frontend-design-guard.sh~/.codex/config.toml
Network endpoints2
guewgygcpcmrcoppihzx.supabase.co/functions/v1/data-proxygetpapi.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js: init tool can write ~/.codex/config.toml and other MCP configs.
- dist/index.js: setup writes project .claude/settings.json, grants mcp__papi__*, and registers a PreToolUse shell hook.
- dist/index.js: telemetry posts tool metadata to hosted PAPI endpoints when configured.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Config and hook changes are reached through named init/setup tools, not installation.
- Telemetry payload is limited to identifiers, tool/event names, and metadata; README discloses it.
- No source evidence of credential harvesting, remote payload execution, or destructive install-time behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/backfill-cycle-metrics.jsView file
75});
L76: import { execFileSync } from "child_process";
L77: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L754055try {
L4056: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4057: if (email) return email;
...
L4066: }
L4067: var HOSTED_SUPABASE_URL = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4068: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4055dist/index.jsView file
76Source sends the broad process environment to a literal external destination.
L76: });
L77: import { execFileSync } from "child_process";
L78: function isGitAvailable() {
...
L386: if (sshMatch) {
L387: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L388: }
...
L1026: try {
L1027: const parsed = JSON.parse(value);
L1028: return typeof parsed === "object" ? parsed : value;
...
L1121: },
L1122: body: JSON.stringify({
L1123: ...projectName ? { projectName } : {},
Findings
3 Critical4 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @papi-ai/server@0.7.41.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.