fastmcp-server
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The framework includes a
FileSystemProviderthat dynamically imports Python modules from a user-defined directory. - Evidence:
references/providers/filesystem.mdexplains that the provider scans a directory for.pyfiles and registers functions usingimportlib.util.spec_from_file_locationat startup or runtime. - [INDIRECT_PROMPT_INJECTION]: The skill provides the ability to read external data and interact with LLMs, creating a surface for indirect prompt injection.
- Ingestion points:
references/context/mcp-context.mddocumentsctx.read_resource(uri), allowing the server to ingest content from arbitrary URIs. - Boundary markers: No evidence of mandatory delimiters or protective instructions in the
ctx.sample()implementation examples inreferences/features/sampling.md. - Capability inventory: Registered tools can perform filesystem operations, network requests, and task scheduling as described in
references/providers/custom.mdandreferences/context/background-tasks.md. - Sanitization: No sanitization or input validation logic is shown in the context of resource reading before sampling.
- [EXTERNAL_DOWNLOADS]: The documentation suggests installing dependencies from the standard Python package registry.
- Evidence:
references/getting-started/installation.mdincludespip install "fastmcp>=3.0.0rc1"andpip install "fastmcp[tasks]". - [COMMAND_EXECUTION]: The guide includes examples of running the framework's server and worker processes via the command line.
- Evidence:
references/context/background-tasks.mddemonstrates the commandfastmcp tasks worker server.py.
Audit Metadata