mcp-builder
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation and SDK information from the official Model Context Protocol website and GitHub repository (github.com/modelcontextprotocol). These are well-known, trusted sources related to the skill's primary purpose.
- [COMMAND_EXECUTION]: The evaluation script (scripts/evaluation.py) uses subprocesses to launch local MCP servers. This behavior is explicitly controlled by user-provided arguments and is necessary for the tool's function as a developer harness.
- [SAFE]: Instructions for using the evaluation harness correctly advise the user to store API keys in environment variables (ANTHROPIC_API_KEY) rather than hardcoding them. The system prompt in the evaluation script uses structural delimiters (XML tags) to separate processing from output, providing defense against potential injection from data.
Audit Metadata