mcp-builder
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/evaluation.pyscript is designed to launch and interact with local MCP servers using standard input/output. This is achieved through thestdiotransport, which executes user-provided commands to start the server process. - [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to fetch documentation and SDK README files from the official Model Context Protocol GitHub organization (
github.com/modelcontextprotocol). These are recognized as trusted sources for development resources. - [PROMPT_INJECTION]: The
scripts/evaluation.pyscript contains a system prompt (EVALUATION_PROMPT) used to instruct an AI model on how to evaluate MCP servers. It processes external data (from evaluation XML files and tool outputs) within an agent loop, representing an indirect prompt injection surface that is inherent to the tool's purpose of testing AI-tool interactions.
Audit Metadata