registry / api2ai / 0.2.11

api2ai@0.2.11

Generate production-ready MCP servers from any OpenAPI specification using the highly-used and convenient [mcp-use](https://mcp-use.com) framework

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Installation automatically invokes documentation generation and a Drizzle schema push. This can mutate a database selected by ambient project configuration; no configured target is included in the package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Potential unconsented local database schema mutation or failed install.

Mechanism

postinstall executes `fumadocs-mdx && drizzle-kit push`

Rationale

The automatic database-changing lifecycle hook is a real unresolved install-time risk, but inspected package files contain no concrete malware, exfiltration, remote payload, or AI-agent-control behavior.

Evidence

package.jsonREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines an automatic postinstall hook.
The hook runs `drizzle-kit push`, which can apply database schema changes during npm install.
Published files list only dist, but this extract contains no dist entrypoint source to substantiate package behavior.

api2ai@0.2.11

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code