registry / @papi-ai/server / 0.7.73
@papi-ai/server@0.7.73
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious: the flagged control-surface writes require explicit setup rather than an npm lifecycle hook, and the installed hook is bounded and warning-only. It warrants a warning because it can scaffold and register an AI-agent extension with executable hook behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `papi setup` or invokes the PAPI setup workflow.
Impact
Modifies project-local AI-agent configuration and can run a project-local warning hook during PAPI builds.
Mechanism
Explicit first-party MCP configuration and agent-extension scaffolding.
AI rationale
Not malicious: the flagged control-surface writes require explicit setup rather than an npm lifecycle hook, and the installed hook is bounded and warning-only. It warrants a warning because it can scaffold and register an AI-agent extension with executable hook behavior.
Evidence
package.jsondist/index.jsdesign-assets/hooks/frontend-design-guard.shdist/backfill-cycle-metrics.js.mcp.json.claude/settings.json.claude/hooks/frontend-design-guard.sh.claude/skills.agents/skills/papi-cycleAGENTS.mdCLAUDE.md.cursor/rules/papi.mdc
Network endpoints3
getpapi.airegistry.npmjs.org/@papi-ai/server/latestguewgygcpcmrcoppihzx.supabase.co
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js: explicit setup writes project .mcp.json with a PAPI MCP entry
- dist/index.js: PAPI setup scaffolds .claude settings, skills, and an executable hook
- dist/index.js: runtime performs default telemetry and npm version-check requests
- design-assets/hooks/frontend-design-guard.sh: installed hook reads tool input and emits workflow guidance
Evidence against
- package.json has no preinstall, install, or postinstall hook
- CLI setup requires an explicit user command and device-browser approval
- hook is scoped to active PAPI builds and states it only warns
- telemetry sends tool metadata; no code/file-content upload path was found
- child-process use is package-aligned Git/GitHub/project workflow functionality
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
78});
L79: import { execFileSync, spawnSync } from "child_process";
L80: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L784268try {
L4269: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4270: if (email) return email;
...
L4279: }
L4280: var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4281: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4268dist/index.jsView file
79});
L80: import { execFileSync, spawnSync } from "child_process";
L81: function isGitAvailable() {
...
L333: }
L334: const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
L335: if (result.status !== 0) {
...
L358: );
L359: const raw = JSON.parse(out);
L360: return raw.map((p) => ({
...
L412: if (sshMatch) {
L413: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L414: }
Findings
2 Critical4 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
Affected versions and remediation
This report applies to @papi-ai/server@0.7.73.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.