rivemcp@1.21.0
Polymation — the AI animation MCP. Author Rive (.riv/.rev) and Spline; convert Lottie, After Effects, Adobe Animate, Figma and glTF into Rive and back; turn AI art into rigged characters, pixel-art puppets, sprite sheets and flipbooks. Offline, checked in
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s own release host and README make the binary download consistent with its distribution model, and the inspected JavaScript shows no concrete malicious data flow. However, the downloaded obfuscated executable is the program users ultimately run, so its behavior cannot be verified from this package snapshot.
Decision evidence
public snapshot- The postinstall script describes the downloaded platform executable as obfuscated and says the package ships no source code.
- Postinstall downloads a versioned executable from the package’s GitHub releases and writes it under bin/.
- The CLI shim starts that executable when the command is invoked.
- The README describes the package as an animation MCP and says installation downloads its standalone binary.
- The download comes from the package’s own GitHub releases, consistent with the README’s stated distribution model.
- The inspected JavaScript shows no collection or transmission of host, project, or credential data.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall script describes the downloaded platform executable as obfuscated and says the package ships no source code.
scripts/postinstall.mjsFindings
Affected versions and remediation
This report applies to rivemcp@1.21.0.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.21.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.