mcp-builder

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The provided evaluation scripts, specifically scripts/evaluation.py and scripts/connections.py, use Python's asynchronous subprocess execution to launch MCP servers locally. This is a functional component of the testing harness designed to communicate with servers via standard I/O (stdio).\n- [EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions for fetching protocol specifications and SDK documentation from official domains, including modelcontextprotocol.io and the modelcontextprotocol GitHub organization. These are well-known, trusted sources for the protocol being taught.\n- [PROMPT_INJECTION]: The evaluation harness in scripts/evaluation.py includes a workflow where results from third-party MCP tools are processed and fed back into the agent's context, creating an indirect prompt injection surface.\n
  • Ingestion points: Data enters the system context through the connection.call_tool() method in scripts/evaluation.py.\n
  • Boundary markers: The harness uses structural XML tags in the system prompt but does not implement specific delimiters or 'ignore' instructions for the tool-provided content.\n
  • Capability inventory: The evaluation agent has access to all tools exposed by the MCP server, and the harness executes local commands as defined by user CLI input.\n
  • Sanitization: Tool outputs are handled as raw strings or JSON without explicit filtering for embedded instructions before being included in the prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 04:34 PM
Security Audit — agent-trust-hub — mcp-builder