mcp-builder
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation from the official Model Context Protocol GitHub repository (github.com/modelcontextprotocol/*). This is a well-known service providing official protocol specifications and SDK documentation.
- [COMMAND_EXECUTION]: The provided evaluation harness (
scripts/evaluation.py) and connection utility (scripts/connections.py) support launching local MCP servers using the stdio transport. This functionality is intended for local development and testing, where a developer specifies the command to execute their own server code. - [DATA_EXFILTRATION]: No patterns of unauthorized data access or exfiltration were found. The tools use standard environment variables and HTTP headers for managing API authentication keys, which is common practice for developer tools.
- [PROMPT_INJECTION]: The evaluation script processes tasks from user-provided XML files. While it interpolates these tasks into prompts for an LLM, it uses structured XML tags to maintain boundaries and is designed as a controlled testing environment for developers.
Audit Metadata