registry / buildpartner / 0.15.1
buildpartner@0.15.1
Your AI build partner. Expert guidance inside Claude Code.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected CLI, MCP server, and API client use the saved BuildPartner credential for requests to the BuildPartner API. The scanner's download-and-run match is a user-visible sign-in instruction, and the package has no lifecycle scripts.
Static reason
No blocking static signals were detected.
Trigger
Explicit CLI use or calls to MCP tools.
Impact
Expected package functionality; no unrelated credential collection, hidden download execution, or other attack behavior found.
Mechanism
Reads BuildPartner auth data locally and sends the saved token to the configured BuildPartner API base. The install command is displayed as text only.
AI rationale
The inspected CLI, MCP server, and API client use the saved BuildPartner credential for requests to the BuildPartner API. The scanner's download-and-run match is a user-visible sign-in instruction, and the package has no lifecycle scripts.
Evidence
~/.buildpartner/auth.json~/.buildpartner/errors.log~/.buildpartner/spool.ndjson
Network endpoints2
www.buildpartner.aiuser-configured API base
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install or lifecycle scripts; its CLI entry runs only when invoked.
- MCP tools check for a locally saved BuildPartner token before making authenticated API requests.
- The API client sends that token to the configured API base, which defaults to www.buildpartner.ai.
- The curl install command appears in a sign-in message; the package does not execute it.
- Local file access is limited to BuildPartner auth and error-log storage.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
4 flaggeddist/src/mcp/server.jsView file
53onst auth = readAuth();
if (!auth?.token)
return textResponse(JSON.stringify({ error: NOT_SIGNED_IN }));
return null;
}
/** Turn an HTTP error status into a me
Low
Ai Review Evidence
MCP tools check for a locally saved BuildPartner token before making authenticated API requests.
dist/src/mcp/server.jsView on unpkg · L5350curl -fsSL https://buildpartner.ai/install.sh | sh — if you already have an account, reconnect this machine at ${CONNECT_URL}`;
/** Check if the user has auth. Ret
Low
Ai Review Evidence
The curl install command appears in a sign-in message; the package does not execute it.
dist/src/mcp/server.jsView on unpkg · L50dist/src/api-client.jsView file
37en)
return null;
try {
const res = await fetch(`${API_BASE}${path}`, {
...options,
headers: {
"Authorization": `Bearer ${auth.token}`,
"Content-Type": "application/
Findings
3 Medium9 Low
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencedist/src/mcp/server.js
LowAi Review Evidencedist/src/api-client.js
LowAi Review Evidencedist/src/mcp/server.js
LowAi Review Evidencedist/src/store/local-store.js
Affected versions and remediation
This report applies to buildpartner@0.15.1.
See all versions of buildpartner for other recorded verdicts.
- Review the evidence and your use of buildpartner@0.15.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.