rivemcp@1.9.1
Polymation — the multi-format AI animation MCP. Author Rive (.riv/.rev) and Spline (.splinecode/.spline) scenes from scratch and convert Rive↔Spline, validated on the real runtime. The most complete Rive MCP, now multi-format.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete unauditable staged-payload delivery path, but inspected source does not show a confirmed malicious action or foreign AI-agent control-surface mutation. It warrants a warning rather than a publish block.
Decision evidence
public snapshot- package.json defines postinstall.
- scripts/postinstall.mjs downloads an opaque executable at install time.
- Downloaded binary has no checksum or signature verification.
- bin/rivemcp.mjs executes that binary with inherited stdio.
- No readable payload beyond installer and shim is shipped.
- No source evidence of credential harvesting, exfiltration, or agent-config writes.
- Installer writes only under its own bin directory.
Source & flagged code
2 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to rivemcp@1.9.1.
See all versions of rivemcp for other recorded verdicts.
- Review the evidence and your use of rivemcp@1.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.