rivemcp@1.13.1
Polymation — the multi-format AI animation MCP. Author Rive (.riv/.rev) and Spline (.splinecode/.spline) scenes from scratch and convert Rive↔Spline, validated on the real runtime. The most complete Rive MCP, now multi-format.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an opaque, unverified remote payload carrier executed through an install-time fetch and runtime shim. No readable source establishes concrete malicious actions, so blocking is not warranted.
Decision evidence
public snapshot- postinstall downloads an obfuscated platform binary absent from the tarball.
- Download follows redirect locations and writes the response directly with no checksum or signature verification.
- The CLI later executes the downloaded binary with inherited stdio.
- The visible JavaScript only targets the package bin directory and a declared GitHub release URL.
- No credential harvesting, agent-config mutation, or destructive behavior appears in readable files.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall downloads an obfuscated platform binary absent from the tarball.
Findings
Affected versions and remediation
This report applies to rivemcp@1.13.1.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.