native-mcp
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The provided file is a documentation resource (SKILL.md) and does not contain any executable scripts or hidden code.
- [COMMAND_EXECUTION]: The documentation describes how the agent can be configured to execute local subprocesses (such as
npxoruvx) to run MCP servers. This is a core feature of the protocol and is controlled by the user through a local configuration file (~/.clawg/config.yaml). - [EXTERNAL_DOWNLOADS]: The instructions suggest installing the official
mcplibrary from standard package registries. It also describes connecting to remote HTTP MCP servers, which is part of the intended functionality. - [CREDENTIALS_UNSAFE]: The documentation uses illustrative placeholders for API keys (e.g.,
ghp_...,sk-...). It explicitly details security mechanisms designed to protect user secrets, including filtering the environment variables passed to subprocesses and stripping credentials from error messages shown to the model.
Audit Metadata