registry / @papi-ai/server / 0.7.98
@papi-ai/server@0.7.98
PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and inspected agent configuration changes are associated with explicit commands or project setup. Credential and network behavior inspected is tied to PAPI settings or operator-provided endpoint configuration, with no confirmed attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the statusline with its install option or invoking project setup for a local frontend project.
Impact
No confirmed attack surface was established.
Mechanism
The statusline adds a command to Claude settings, while project setup can register the package’s design hook. The inspected code shows no install lifecycle hook or covert configuration mutation.
AI rationale
The manifest has no install lifecycle hook, and inspected agent configuration changes are associated with explicit commands or project setup. Credential and network behavior inspected is tied to PAPI settings or operator-provided endpoint configuration, with no confirmed attack behavior.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the server entrypoint and lists build, start, backfill, and prepack scripts; it has no install lifecycle hook.
- The backfill match selects Claude instruction files and documentation for a Git diff; it does not write agent configuration.
- The index match likewise selects Claude instruction files and documentation for a Git diff.
- The statusline reads PAPI server settings from the project’s MCP configuration; its settings write is gated by an explicit install option.
- The server adds its project design hook during local project setup when a frontend stack is detected.
- Prompt retrieval uses operator-provided endpoint and API-key environment variables; telemetry is gated and uses PAPI data credentials.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/backfill-cycle-metrics.jsView file
261});
L262: import { execFileSync, spawnSync } from "child_process";
L263: function isGitAvailable() {
High
Child Process
Package source references child process execution.
dist/backfill-cycle-metrics.jsView on unpkg · L261dist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
const hostedSupabaseUrl = cleanUrl(env.hostedSupabaseUrl);
dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/function...
import { mkdirSync, readFileSync as readFileSync2, writeFileSync, chmodSync } from "fs";
hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"]
"Authorization": `Bearer ${apiKey}`
"Authorization": `Bearer ${this.apiKey}`
`Auth: Invalid API key \u2014 PAPI_DATA_API_KEY was rejected by the proxy.
* Validate API key and project access against the proxy.
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
5 High4 Medium5 Low
HighChild Processdist/backfill-cycle-metrics.js
HighShell
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighExternal Ai Agent Control Surface Mutationdist/statusline.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdesign-assets/hooks/frontend-design-guard.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @papi-ai/server@0.7.98.
See all versions of @papi-ai/server for other recorded verdicts.
- Review the evidence and your use of @papi-ai/server@0.7.98 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.