rivemcp@1.13.2
Polymation — the multi-format AI animation MCP. Author Rive (.riv/.rev) and Spline (.splinecode/.spline) scenes from scratch and convert Rive↔Spline, validated on the real runtime. The most complete Rive MCP, now multi-format.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an install-time staged payload carrier with no packaged readable implementation or integrity verification. Source inspection does not prove malicious payload behavior, so it warrants warning rather than blocking.
Decision evidence
public snapshot- Install-time script downloads an obfuscated platform binary from GitHub Releases.
- Downloaded binary is written into bin and made executable on non-Windows hosts.
- CLI shim executes that downloaded binary with inherited stdio.
- No checksum or signature verification is present before execution.
- Inspected JavaScript contains no credential harvesting, environment collection, or agent-config mutation.
- The visible network target is a package-named GitHub release path, not a covert endpoint.
- The remote binary is not included here, so concrete malicious behavior cannot be established from source.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time script downloads an obfuscated platform binary from GitHub Releases.
package.jsonView on unpkg · L51Findings
Affected versions and remediation
This report applies to rivemcp@1.13.2.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.