mcp-builder
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and tools for a legitimate developer workflow (MCP server creation and evaluation).
- [EXTERNAL_DOWNLOADS]: The skill suggests fetching documentation from the official Model Context Protocol GitHub repositories (specifically
modelcontextprotocol/python-sdkandmodelcontextprotocol/typescript-sdk). These are well-known and official sources for the protocol. - [COMMAND_EXECUTION]: The
evaluation.pyscript is a testing harness that executes a user-specified command to launch an MCP server for evaluation. This is standard functionality for local development and testing tools. - [INDIRECT_PROMPT_INJECTION]: The evaluation script processes external XML data and tool outputs from the server being tested. It uses clear boundary markers in its system prompt (e.g.,
<summary>,<feedback>,<response>tags) to maintain control over the LLM's output structure during testing.
Audit Metadata