mcp-builder

This fragment does not show direct embedded malware (no exec/eval payloads, no hardcoded credentials, no explicit malicious network destinations). However, it implements an LLM-driven agent that can execute MCP tools based solely on untrusted model output and then forwards tool outputs (and even tracebacks) back into the LLM/API context. In a supply-chain/agent threat model, this is a meaningful security risk: if the MCP server/tools are overly powerful or compromised, the model can be induced to trigger sensitive actions and leak retrieved data to the Anthropic API. Recommended mitigations include strict tool allowlisting, input/schema validation for tool_name/tool_input, limiting tool capabilities/permissions, truncating/redacting tool outputs, and avoiding sending tracebacks to the model.