mcp-builder
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The testing harness (
scripts/evaluation.py) and connection utility (scripts/connections.py) enable the execution of local shell commands via the 'stdio' transport. This is a core functionality designed to launch and test local MCP servers during development. - [EXTERNAL_DOWNLOADS]: The skill provides links to official SDK repositories and protocol documentation hosted by the 'modelcontextprotocol' organization on GitHub. These are well-known, trusted resources for developers.
- [PROMPT_INJECTION]: The evaluation script (
scripts/evaluation.py) processes external data from XML files and MCP server outputs. This represents an indirect prompt injection surface. The ingestion points include the 'eval_file' XML content and results from 'connection.call_tool'. The skill uses specific XML tags ('', '', '') in its system prompt to structure the agent's output and manage context. Capabilities available to the script include local subprocess execution and Anthropic API access. Sanitization relies on standard JSON and XML parsing within the 'mcp' and 'anthropic' libraries.
Audit Metadata