GitHub Agentic Workflows MCP Configuration
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Provides implementation patterns for spawning local MCP server processes using
child_process.spawn. - Evidence: The
MCPLifecycleManagerclass inSKILL.mddemonstrates spawning processes based on configuration commands and arguments for local servers. - [COMMAND_EXECUTION]: Includes example code for validating the presence of command-line tools using
child_process.execSync. - Evidence: The
MCPConfigValidatorclass usescommand -vto verify if required commands are available in the environment. - [COMMAND_EXECUTION]: Documents patterns for building filesystem tools that read, write, and list directories.
- Evidence: The
FileSystemMCPServerexample implementsread_file,write_file, andlist_directorytools, including path validation logic to mitigate directory traversal risks. - [EXTERNAL_DOWNLOADS]: References official schemas and repositories from the Model Context Protocol (MCP) project on GitHub.
- Evidence: Links to
https://github.com/modelcontextprotocol/schema/v1and official SDK repositories. - [EXTERNAL_DOWNLOADS]: Recommends the execution of official MCP servers using the
npxpackage runner. - Evidence: Example configuration uses
npx -y @modelcontextprotocol/server-filesystemto run the official filesystem server.
Audit Metadata