GitHub Agentic Workflows MCP Configuration

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Provides implementation patterns for spawning local MCP server processes using child_process.spawn.
  • Evidence: The MCPLifecycleManager class in SKILL.md demonstrates spawning processes based on configuration commands and arguments for local servers.
  • [COMMAND_EXECUTION]: Includes example code for validating the presence of command-line tools using child_process.execSync.
  • Evidence: The MCPConfigValidator class uses command -v to verify if required commands are available in the environment.
  • [COMMAND_EXECUTION]: Documents patterns for building filesystem tools that read, write, and list directories.
  • Evidence: The FileSystemMCPServer example implements read_file, write_file, and list_directory tools, including path validation logic to mitigate directory traversal risks.
  • [EXTERNAL_DOWNLOADS]: References official schemas and repositories from the Model Context Protocol (MCP) project on GitHub.
  • Evidence: Links to https://github.com/modelcontextprotocol/schema/v1 and official SDK repositories.
  • [EXTERNAL_DOWNLOADS]: Recommends the execution of official MCP servers using the npx package runner.
  • Evidence: Example configuration uses npx -y @modelcontextprotocol/server-filesystem to run the official filesystem server.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 11:42 PM