rivemcp@1.16.0
Polymation — the multi-format AI animation MCP. Author Rive (.riv/.rev) and Spline (.splinecode/.spline) scenes from scratch and convert Rive↔Spline, validated on the real runtime. The most complete Rive MCP, now multi-format.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe install-time download and later execution of an opaque binary leave a concrete payload risk that the inspected source cannot resolve. The package-specific, versioned GitHub endpoint and user-invoked CLI provide no source evidence of an attack, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The package postinstall hook runs scripts/postinstall.mjs automatically.
- The installer downloads a platform-specific binary from the package’s GitHub releases URL and writes it into bin/.
- The CLI shim launches the downloaded binary when invoked.
- The download URL uses the package version and a package-specific GitHub releases repository.
- The inspected source shows no credential collection or unrelated file writes; the binary runs only when the CLI is invoked.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package postinstall hook runs scripts/postinstall.mjs automatically.
package.jsonView on unpkg · L55Findings
Affected versions and remediation
This report applies to rivemcp@1.16.0.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.