harper-mcp
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation-only resource providing integration guidelines and code examples. It does not contain any executable scripts or autonomous commands that run during the skill's load process.
- [SAFE]: The skill explicitly emphasizes security best practices, including a 'Hardening Checklist' in
security-posture.mdthat guides users on protecting public endpoints using CORS, rate limiting, and identity validation. - [SAFE]: The code snippets provided (JavaScript/TypeScript for MCP tools and resources) include defensive programming patterns, such as verifying user context (
context.user) and warning against path traversal when constructing filesystem paths from URI templates. - [SAFE]: Examples of configuration (
harper-config.yaml) and network requests (curl) use standard documentation placeholders (e.g.,admin:password,localhost) for educational purposes and do not represent a credential exposure risk for actual deployments.
Audit Metadata