assistant-mcp
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the mcp-grafana server directly from Grafana's official GitHub repository using the Go toolchain (go install github.com/grafana/mcp-grafana/cmd/mcp-grafana@latest).
- [COMMAND_EXECUTION]: Instructs the user to execute shell commands to install, verify, and run the MCP server as either a subprocess or a persistent SSE service.
- [PROMPT_INJECTION]: The skill documents an attack surface for indirect prompt injection, as the agent is designed to process external data that could contain malicious instructions. Ingestion points: External data processed via tool outputs from query_prometheus, query_loki, query_tempo, and get_dashboard. Boundary markers: None explicitly provided in the configuration examples. Capability inventory: The server provides tools for querying metrics, logs, and traces, as well as the ability to create or update Grafana dashboards. Sanitization: No specific sanitization or filtering logic is provided in the configuration; the skill suggests using read-only mode (--disable-write) as a mitigation.
Audit Metadata