mcp-builder

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes Python scripts (scripts/evaluation.py and scripts/connections.py) that enable running local MCP servers. These scripts use the standard stdio transport to spawn subprocesses for the server commands, which is the documented and expected method for testing MCP integrations.
  • [PROMPT_INJECTION]: The evaluation harness reads test questions from user-provided XML files. While this creates a surface for indirect prompt injection if untrusted files are used, it is a standard design pattern for an automated LLM evaluation framework and does not represent a malicious intent in this context.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 04:45 PM
Security Audit — agent-trust-hub — mcp-builder