spring-ai-mcp-server-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely composed of documentation and Java code snippets provided as implementation patterns for developers. It does not include any executable scripts or hidden commands.
- [EXTERNAL_DOWNLOADS]: The skill references official Spring AI dependencies (e.g.,
spring-ai-mcp-server) in Maven and Gradle snippets. These target a well-known service and are documented neutrally as project configuration. - [COMMAND_EXECUTION]: Documentation provides patterns for building tools that interact with databases and the file system. These include security best practices such as parameterized queries, read-only SELECT constraints, and path normalization to prevent injection and traversal attacks.
- [DYNAMIC_EXECUTION]: The patterns include a dynamic tool registration example using Groovy scripts. This is presented as an advanced feature for developers and includes role-based authorization checks in the provided code.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies the attack surface presented by tools fetching external data and correctly advises on input validation and sanitization as primary mitigations.
Audit Metadata