mcp-builder
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/evaluation.pyandscripts/connections.pyscripts allow for the execution of local processes through thestdiotransport mechanism. This functionality is intended to allow developers to run and test their MCP servers locally during the development lifecycle. - [EXTERNAL_DOWNLOADS]: The documentation in
SKILL.mdincludes instructions to fetch README files and protocol specifications from the officialmodelcontextprotocolGitHub organization. These are recognized resources for the protocol being implemented. - [REMOTE_CODE_EXECUTION]: The evaluation harness executes commands provided via CLI arguments to interact with local MCP servers. This is a core feature required for the tool's primary purpose of evaluating server performance and accuracy.
- [PROMPT_INJECTION]: The
scripts/evaluation.pyscript ingests data from XML evaluation files and tool outputs, which represents an indirect prompt injection surface. The script mitigates this by using specific XML tags as boundary markers and providing explicit system instructions to the agent to maintain response structure.
Audit Metadata