registry / api2ai / 0.2.13

api2ai@0.2.13

Generate production-ready MCP servers from any OpenAPI specification using the highly-used and convenient [mcp-use](https://mcp-use.com) framework

AI Security Review

scanned 4h ago · by lpm-firewall-ai

npm installation triggers an automatic Drizzle schema push. No package source establishes exfiltration or a remote payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

May alter a database selected by ambient project Drizzle configuration.

Mechanism

postinstall database schema migration

Rationale

The automatic database-mutating lifecycle hook is a real installation-time risk, but inspected files contain no concrete malicious behavior. Warn rather than block.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json: postinstall runs `drizzle-kit push` automatically.
The lifecycle command can apply database schema changes during npm install.
Published entrypoints reference dist/, but no dist files are present.

Evidence against

No source code, binaries, or hidden files beyond package.json and README.md.

api2ai@0.2.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code