mcp-builder
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references documentation and SDK resources from
modelcontextprotocol.ioand the officialmodelcontextprotocolGitHub organization. These represent well-known and trusted sources for the Model Context Protocol framework. - [COMMAND_EXECUTION]: The evaluation harness script (
scripts/evaluation.py) enables testing of local MCP servers using thestdiotransport. This involves executing shell commands and arguments that are explicitly provided by the user during command-line invocation. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface through its evaluation harness, which processes external task descriptions and tool outputs.
- Ingestion points: Data enters the system via evaluation XML files and results returned by the MCP tools under test.
- Boundary markers: The system prompt in
evaluation.pyuses XML tags (<summary>,<feedback>,<response>) to structure and isolate agent outputs. - Capability inventory: The script can spawn subprocesses (for
stdioservers) and perform network requests to the Anthropic API. - Sanitization: The script utilizes standard XML parsing libraries and regular expression extraction to manage data flow.
Audit Metadata