fastmcp-server

Warn

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The framework includes a FileSystemProvider that dynamically imports Python modules from a user-defined directory.
  • Evidence: references/providers/filesystem.md explains that the provider scans a directory for .py files and registers functions using importlib.util.spec_from_file_location at startup or runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides the ability to read external data and interact with LLMs, creating a surface for indirect prompt injection.
  • Ingestion points: references/context/mcp-context.md documents ctx.read_resource(uri), allowing the server to ingest content from arbitrary URIs.
  • Boundary markers: No evidence of mandatory delimiters or protective instructions in the ctx.sample() implementation examples in references/features/sampling.md.
  • Capability inventory: Registered tools can perform filesystem operations, network requests, and task scheduling as described in references/providers/custom.md and references/context/background-tasks.md.
  • Sanitization: No sanitization or input validation logic is shown in the context of resource reading before sampling.
  • [EXTERNAL_DOWNLOADS]: The documentation suggests installing dependencies from the standard Python package registry.
  • Evidence: references/getting-started/installation.md includes pip install "fastmcp>=3.0.0rc1" and pip install "fastmcp[tasks]".
  • [COMMAND_EXECUTION]: The guide includes examples of running the framework's server and worker processes via the command line.
  • Evidence: references/context/background-tasks.md demonstrates the command fastmcp tasks worker server.py.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 15, 2026, 02:28 PM