mcp-builder

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation and SDKs from official GitHub repositories, such as github.com/modelcontextprotocol/typescript-sdk. These are well-known, trusted sources for MCP development.
  • [COMMAND_EXECUTION]: The scripts/evaluation.py script and scripts/connections.py module are designed to launch and interact with MCP servers. When using the stdio transport, the script executes a command-line instruction provided by the user to start the server process. This is the standard method for testing local MCP servers.
  • [DYNAMIC_EXECUTION]: The evaluation harness implements an autonomous agent loop that dynamically calls tools on the connected MCP server and processes the results to answer test questions. This is the core functional requirement of the evaluation script.
  • [INDIRECT_PROMPT_INJECTION]: The scripts/evaluation.py script reads test questions from an external XML file (evaluation.xml). These questions are then included in a prompt for an LLM. This creates a surface for indirect prompt injection if the test file contains malicious instructions.
  • Ingestion points: The parse_evaluation_file function in scripts/evaluation.py reads data from a user-specified XML file.
  • Boundary markers: The script uses specific XML-like tags (<summary>, <feedback>, <response>) to structure the agent's output, but does not provide explicit boundaries or "ignore" instructions for the input questions.
  • Capability inventory: The script can execute subprocesses (via stdio transport) and perform network operations (connecting to the Anthropic API and remote MCP servers).
  • Sanitization: There is no sanitization or filtering of the question content before it is processed by the agent loop.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:47 PM