mcp-management

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary function is to manage and interact with MCP servers. This involves spawning subprocesses to run server executables as defined in the local configuration file .claude/.mcp.json. This behavior is implemented in scripts/mcp-client.ts using the @modelcontextprotocol/sdk.
  • [EXTERNAL_DOWNLOADS]: The documentation in README.md and references/configuration.md recommends running various MCP servers (such as @modelcontextprotocol/server-memory and server-filesystem) using npx -y. This command pulls the latest versions of these packages from the npm registry during execution.
  • [REMOTE_CODE_EXECUTION]: The assets/tools.json metadata file includes definitions for high-capability tools like evaluate_script from the chrome-devtools server and eval equivalents in other servers. These tools allow for the execution of arbitrary code within their respective sandboxed environments (e.g., a browser or an isolated node process), which is an intended capability for these specific developer tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 01:36 AM
Security Audit — agent-trust-hub — mcp-management