rivemcp@1.20.0
Polymation — the AI animation MCP. Author Rive (.riv/.rev) and Spline; convert Lottie, After Effects, Adobe Animate, Figma and glTF into Rive and back; turn AI art into rigged characters, pixel-art puppets, sprite sheets and flipbooks. Offline, checked in
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package's install-time download and command shim serve its documented animation MCP purpose, with no unrelated data collection or account actions found. The downloaded executable itself is not present as readable source in this snapshot.
Decision evidence
public snapshot- The package describes itself as an MCP for authoring and converting animation formats.
- Postinstall downloads a platform-specific executable from the project's GitHub releases host and saves it under bin/.
- The launcher starts that executable when the rivemcp command is invoked.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package describes itself as an MCP for authoring and converting animation formats.
README.mdView on unpkg · L3Findings
Affected versions and remediation
This report applies to rivemcp@1.20.0.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.