registry / @papi-ai/server / 0.7.75
@papi-ai/server@0.7.75
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's command-exfiltration claim is not supported by the inspected source: child-process use is project Git/GitHub workflow functionality. The confirmed concern is explicit setup-time Claude configuration and a project hook, which warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User invokes the MCP setup tool; design hook registration additionally requires a detected frontend project.
Impact
Modifies the current project's Claude Code control surface and sends usage metadata during tool calls.
Mechanism
Explicit project-local AI-agent extension setup plus opt-out telemetry.
AI rationale
The scanner's command-exfiltration claim is not supported by the inspected source: child-process use is project Git/GitHub workflow functionality. The confirmed concern is explicit setup-time Claude configuration and a project hook, which warrants a warning rather than a block.
Evidence
package.jsondist/index.jsdesign-assets/hooks/frontend-design-guard.shREADME.md.claude/settings.json.claude/hooks/frontend-design-guard.sh.claude/skillsAGENTS.md.agents/skills/papi-cycle.papi
Network endpoints2
guewgygcpcmrcoppihzx.supabase.co/functions/v1/data-proxyguewgygcpcmrcoppihzx.supabase.co/rest/v1/md_adapter_pings
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js: explicit setup writes .claude/settings.json
- dist/index.js: setup installs a PreToolUse shell hook for Edit/Write
- design-assets/hooks/frontend-design-guard.sh: hook reads tool input and emits warnings
- dist/index.js: runtime telemetry posts tool metadata to PAPI Supabase
Evidence against
- package.json has no preinstall/install/postinstall hook
- setup is an explicitly invoked MCP tool with prepare/apply flow
- hook is scoped to active PAPI UI edits and exits without blocking
- telemetry is documented and can be disabled with PAPI_TELEMETRY=off
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
81});
L82: import { execFileSync, spawnSync } from "child_process";
L83: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L814307try {
L4308: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4309: if (email) return email;
...
L4318: }
L4319: var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4320: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4307dist/index.jsView file
82});
L83: import { execFileSync, spawnSync } from "child_process";
L84: function isGitAvailable() {
...
L120: if (add.status !== 0) {
L121: return { committed: false, message: (add.stderr || "git add failed").trim() };
L122: }
...
L397: );
L398: const raw = JSON.parse(out);
L399: return raw.map((p) => ({
...
L451: if (sshMatch) {
L452: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L453: }
Findings
2 Critical4 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
Affected versions and remediation
This report applies to @papi-ai/server@0.7.75.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.75 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.