research
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The script reads authentication tokens from the local
~/.mcp-auth/directory. It includes a validation function that parses the JWT (JSON Web Token) to ensure it was issued by the official Tavily endpoint and has not expired before attempting to use it. - [EXTERNAL_DOWNLOADS]: When no local credentials are found, the skill uses
npxto download and run themcp-remoteutility. This tool is a standard part of the Model Context Protocol ecosystem used to facilitate secure remote authentication. - [COMMAND_EXECUTION]: The script executes several system commands including
findto locate configuration files,curlto communicate with the Tavily research API, andjqto process and validate JSON data structures.
Audit Metadata