AgentArmorHQ
Sign in

@oscarlin007/piece-any-ai

MCP server · npm · graded 2026-10-31Source linked

We found no security report about this add-on in the sources we read (checked 2026-11-01). That does not prove it is harmless.

Use your own LLM API key (OpenRouter, OpenAI, Groq, Ollama, or any OpenAI-compatible endpoint) inside Activepieces without spending AI credits. Includes TinyFish, MCP servers and Composio apps.

No outside reports on file

@oscarlin007/piece-any-ai requires API keys or tokens; restrict its folder reach, network access, and credentials before installing.

Based on public adoption and transparency signals as of Oct 31, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for @oscarlin007/piece-any-ai helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachLocal or standard API callsLOW
  • CredentialsRequires API key or tokenREVIEW
  • Package sourcenpm (@oscarlin007/piece-any-ai)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y @oscarlin007/piece-any-ai

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

We found nothing about this project in the sources we read (last checked 2026-11-01). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-11-01

Popularity grade: F (from public signals such as stars and downloads, not a code review). Graded 2026-10-31.

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-11-01.

Check a specific version →

About @oscarlin007/piece-any-ai

@oscarlin007/piece-any-ai is an MCP server focused on Developer tools and Cloud & infrastructure: Use your own LLM API key (OpenRouter, OpenAI, Groq, Ollama, or any OpenAI-compatible endpoint) inside Activepieces without spending AI credits. Includes TinyFish, MCP servers and Composio apps.

It is published on npm as @oscarlin007/piece-any-ai. Based on its public metadata, its operational scope includes: requires api key or token.

Setup

These use the package this listing points to. Check the project’s own instructions before running anything.

npm command

npx -y @oscarlin007/piece-any-ai

MCP client config

For Claude Desktop (claude_desktop_config.json) or Cursor (.cursor/mcp.json).

json
{
  "mcpServers": {
    "piece-any-ai": {
      "command": "npx",
      "args": [
        "-y",
        "@oscarlin007/piece-any-ai"
      ]
    }
  }
}

Why this grade

FF — Many risk signals

Signal-based grade (0/7 points): no public source code found. This reflects adoption and transparency, not a code review.

Popularity and upkeep

4/100
Listing last refreshed
2026-10-31

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Credential & token exposure: Requires API keys or secrets in configuration. Store credentials in environment variables with read-only or minimum required scopes and rotate them regularly.
  • Dependency & version pinning: Distributed via npm (@oscarlin007/piece-any-ai). Pin an exact release version or commit SHA rather than floating tags so upstream updates are reviewed first.

How to lower the risk

Least-privilege permissions

  • Give it access only to the specific folders, accounts or projects it needs, never your whole drive or admin account.
  • Use a separate, limited API key or login just for this tool so you can switch it off without affecting anything else.

Network isolation

  • Run it on a work computer or sandbox account, not one holding personal or company-sensitive data.
  • If your IT team can, limit which websites and services it is allowed to contact.

Monitoring

  • Check its activity history or logs weekly at first, and look at what it changed or sent.
  • Turn on alerts for new logins or unusual usage on any account it connects to.

Red flags to watch for

  • It asks for more access than its job requires, or prompts you to paste passwords.
  • It suddenly updates with new owners, or starts contacting unfamiliar websites.

Questions

How do I install @oscarlin007/piece-any-ai?

Run npx -y @oscarlin007/piece-any-ai in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page.

Are there security reports about @oscarlin007/piece-any-ai?

We found no security report about this add-on in the sources we read (checked 2026-11-01). @oscarlin007/piece-any-ai currently holds Grade F (Many risk signals) based on public adoption and transparency signals. Review the permissions and source repository before granting access to local files, shell commands, or API keys.

Is @oscarlin007/piece-any-ai actively maintained?

We do not have star or download counts on file for @oscarlin007/piece-any-ai yet (listing refreshed 2026-10-31). Check the commit history and open issues before relying on it.

What are alternatives to @oscarlin007/piece-any-ai?

Compare @oscarlin007/piece-any-ai side by side with similar MCP servers in the Related tools section on this page, or browse all MCP servers on AgentArmorHQ.

README badge and team notes

Maintain or use @oscarlin007/piece-any-ai? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade F for @oscarlin007/piece-any-ai

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for @oscarlin007/piece-any-ai](https://agentarmorhq.com/api/badge/oscarlin007-piece-any-ai)](https://agentarmorhq.com/skills/oscarlin007-piece-any-ai)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/oscarlin007-piece-any-ai"><img src="https://agentarmorhq.com/api/badge/oscarlin007-piece-any-ai" alt="AgentArmorHQ Risk Grade for @oscarlin007/piece-any-ai" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "oscarlin007-piece-any-ai"

Share with your security lead

Need sign-off to use @oscarlin007/piece-any-ai? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: @oscarlin007/piece-any-ai
- **Listing URL:** https://agentarmorhq.com/skills/oscarlin007-piece-any-ai
- **Type:** App connector
- **Risk Grade:** Grade F (Many risk signals)
- **Outside Security Advisories on File:** 0

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** Requires API key or token
- **Package source:** npm (@oscarlin007/piece-any-ai)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts @oscarlin007/piece-any-ai`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 31, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Install command
npm install @oscarlin007/piece-any-ai
Est. context load
~900 tokens / turn (~5 tool schemas, 0.45% of 200k context)
Last updated
2026-10-31
Last graded
2026-10-31

Community

Discussions for @oscarlin007/piece-any-ai

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for @oscarlin007/piece-any-ai helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside ClaudeWatch for bad updates