@papi-ai/server@0.7.76
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection disproves the scanner's install-time and command-output-exfiltration implication. The remaining user-triggered agent configuration and default identifiable telemetry justify a warning, not a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the server and invoke an MCP tool in md mode, or explicitly run setup/init.
Impact
Can modify selected PAPI agent configuration and transmit Git/GitHub email plus limited usage metadata to the vendor endpoint.
Mechanism
Tool-triggered MCP configuration writes and default telemetry emission.
AI rationale
Source inspection disproves the scanner's install-time and command-output-exfiltration implication. The remaining user-triggered agent configuration and default identifiable telemetry justify a warning, not a block.
Evidence
package.jsondist/index.js~/.papi/install-id.json.mcp.json.cursor/mcp.json.vscode/mcp.json~/.codex/config.toml~/.hermes/config.yaml
Network endpoints3
guewgygcpcmrcoppihzx.supabase.co/functions/v1/data-proxyguewgygcpcmrcoppihzx.supabase.co/rest/v1/md_adapter_pingsgetpapi.ai
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js automatically reads git/GitHub email for md-mode user ID.
- dist/index.js sends md-mode telemetry with install ID, user ID, project slug, tool name, and result metadata.
- dist/index.js can write PAPI MCP entries to project and user-scoped agent configs through explicit setup/init actions.
- dist/index.js executes git/gh commands for its project-management tools.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Config writes occur only through explicit CLI/MCP setup or init paths; reset prompts before removal.
- No remote payload download/eval chain or arbitrary shell execution was found.
- Observed endpoints are PAPI/Supabase service endpoints aligned with the package's hosted adapter.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/backfill-cycle-metrics.jsView file
81});
L82: import { execFileSync, spawnSync } from "child_process";
L83: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L814320try {
L4321: const email = execSync("git config user.email", { encoding: "utf8", timeout: 5e3 }).trim();
L4322: if (email) return email;
...
L4331: }
L4332: var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
L4333: var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/backfill-cycle-metrics.jsView on unpkg · L4320dist/index.jsView file
82});
L83: import { execFileSync, spawnSync } from "child_process";
L84: function isGitAvailable() {
...
L120: if (add.status !== 0) {
L121: return { committed: false, message: (add.stderr || "git add failed").trim() };
L122: }
...
L397: );
L398: const raw = JSON.parse(out);
L399: return raw.map((p) => ({
...
L451: if (sshMatch) {
L452: return `https://${sshMatch[1]}/${sshMatch[2]}`;
L453: }
Findings
2 Critical4 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighSame File Env Network Executiondist/backfill-cycle-metrics.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
Affected versions and remediation
This report applies to @papi-ai/server@0.7.76.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.