@papi-ai/server@0.7.71
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner’s command-output-exfiltration claim is not supported by the inspected telemetry implementation. This is a real, user-invoked agent-configuration capability, but not concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the papi-server CLI or explicitly invokes its init/setup MCP tools.
Impact
Can modify requested project or selected user-scoped MCP configuration and transmit PAPI project data to the configured service.
Mechanism
explicit AI-agent configuration/scaffolding and authenticated project API calls
AI rationale
The scanner’s command-output-exfiltration claim is not supported by the inspected telemetry implementation. This is a real, user-invoked agent-configuration capability, but not concrete malicious behavior.
Evidence
package.jsondist/index.jsdist/backfill-cycle-metrics.js.mcp.jsonCLAUDE.md.claude/settings.json.cursor/rules/papi.mdc~/.papi/install-id.json
Network endpoints3
guewgygcpcmrcoppihzx.supabase.co/functions/v1/data-proxyguewgygcpcmrcoppihzx.supabase.co/rest/v1/md_adapter_pingsregistry.npmjs.org/@papi-ai/server/latest
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js exposes explicit init/setup commands that write MCP and AI-agent project configuration.
- dist/index.js setup scaffolding includes CLAUDE.md, .claude/settings.json, and Cursor rules.
- dist/index.js sends authenticated PAPI project operations and opt-out telemetry to its Supabase proxy.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- CLI writes are reached only through explicit init/setup/reset commands or MCP tool calls.
- Git child-process use is for project/repository workflow operations; no arbitrary shell payload was found.
- Telemetry payloads shown contain tool metadata, project identifiers, and an install ID, not command output.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
78});
L79: import { execFileSync, spawnSync } from "child_process";
L80: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L784261try {
L4262: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4263: if (email) return email;
...
L4272: }
L4273: var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4274: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4261dist/index.jsView file
79});
L80: import { execFileSync, spawnSync } from "child_process";
L81: function isGitAvailable() {
...
L333: }
L334: const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
L335: if (result.status !== 0) {
...
L358: );
L359: const raw = JSON.parse(out);
L360: return raw.map((p) => ({
...
L412: if (sshMatch) {
L413: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L414: }
Findings
2 Critical4 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
Affected versions and remediation
This report applies to @papi-ai/server@0.7.71.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.71 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.