@papi-ai/server@0.7.72
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe static malicious finding overstates package-aligned Git and telemetry behavior; command output is not sent to a third party. Policy still calls for a warning for explicit user-command AI-agent configuration mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `papi-server setup` or invokes the `init` MCP tool; telemetry occurs while the server runs with configured credentials.
Impact
Adds a PAPI MCP endpoint to selected clients and may modify/push user project Git state through invoked workflow tools.
Mechanism
explicit AI-client configuration provisioning, Git workflow automation, and telemetry
AI rationale
The static malicious finding overstates package-aligned Git and telemetry behavior; command output is not sent to a third party. Policy still calls for a warning for explicit user-command AI-agent configuration mutation.
Evidence
package.jsondist/index.js.mcp.json.cursor/mcp.json.vscode/mcp.json~/.codex/config.toml~/.hermes/config.yaml~/.papi/install-id.json
Network endpoints3
getpapi.aiguewgygcpcmrcoppihzx.supabase.coregistry.npmjs.org/@papi-ai/server/latest
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.js: CLI setup writes a PAPI MCP entry with API credentials to .mcp.json.
- dist/index.js: init tool can write PAPI MCP configuration for several AI clients, including user-scoped Codex/Hermes configs.
- dist/index.js: runtime creates a persistent ~/.papi/install-id.json and sends telemetry when enabled.
- dist/index.js: release/workflow functions invoke git commands and can commit or push project changes.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Configuration mutation is exposed through explicit setup/init commands or MCP tools, not package installation.
- Telemetry payload construction contains tool/milestone metadata and project identifiers; no command output or harvested file content is sent.
- Network hosts are package-aligned PAPI/Supabase services and npm registry.
- No eval, arbitrary shell string execution, payload download/execution, or credential harvesting found.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
78});
L79: import { execFileSync, spawnSync } from "child_process";
L80: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L784268try {
L4269: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4270: if (email) return email;
...
L4279: }
L4280: var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4281: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4268dist/index.jsView file
79});
L80: import { execFileSync, spawnSync } from "child_process";
L81: function isGitAvailable() {
...
L333: }
L334: const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
L335: if (result.status !== 0) {
...
L358: );
L359: const raw = JSON.parse(out);
L360: return raw.map((p) => ({
...
L412: if (sshMatch) {
L413: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L414: }
Findings
2 Critical4 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
Affected versions and remediation
This report applies to @papi-ai/server@0.7.72.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.