rivemcp@1.14.1
Polymation — the multi-format AI animation MCP. Author Rive (.riv/.rev) and Spline (.splinecode/.spline) scenes from scratch and convert Rive↔Spline, validated on the real runtime. The most complete Rive MCP, now multi-format.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an opaque remote-payload delivery chain with automatic installation, but the inspected source does not establish credential theft, persistence outside the package, or another concrete malicious action. It should be warned rather than blocked.
Decision evidence
public snapshot- The npm postinstall hook automatically runs a downloader.
- The installer fetches an obfuscated platform binary without an integrity check and writes it into bin.
- The command shim later launches that downloaded binary with inherited standard input and output.
- The inspected JavaScript contains no credential harvesting, environment collection, AI-agent configuration writes, or destructive file operations.
- The visible downloader targets a versioned GitHub release URL and only writes its own package bin directory.
- No runtime self-dependency or foreign project mutation is present in the manifest or inspected scripts.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe npm postinstall hook automatically runs a downloader.
package.jsonView on unpkg · L44Findings
Affected versions and remediation
This report applies to rivemcp@1.14.1.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.14.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.