mcp-management
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is to manage and interact with MCP servers. This involves spawning subprocesses to run server executables as defined in the local configuration file
.claude/.mcp.json. This behavior is implemented inscripts/mcp-client.tsusing the@modelcontextprotocol/sdk. - [EXTERNAL_DOWNLOADS]: The documentation in
README.mdandreferences/configuration.mdrecommends running various MCP servers (such as@modelcontextprotocol/server-memoryandserver-filesystem) usingnpx -y. This command pulls the latest versions of these packages from the npm registry during execution. - [REMOTE_CODE_EXECUTION]: The
assets/tools.jsonmetadata file includes definitions for high-capability tools likeevaluate_scriptfrom thechrome-devtoolsserver andevalequivalents in other servers. These tools allow for the execution of arbitrary code within their respective sandboxed environments (e.g., a browser or an isolated node process), which is an intended capability for these specific developer tools.
Audit Metadata