mcp-builder
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/evaluation.pyandscripts/connections.pyfiles provide functionality to execute local commands via thestdiotransport to launch MCP servers. This is an intended feature of the testing harness, allowing developers to run and test their server implementations as subprocesses. - [EXTERNAL_DOWNLOADS]: The documentation and guides within the skill reference official resources from the Model Context Protocol organization (
modelcontextprotocol.ioandgithub.com/modelcontextprotocol). These are well-known official sources for the protocol's SDKs and specifications. - [INDIRECT_PROMPT_INJECTION]: The
scripts/evaluation.pyscript implements an autonomous agent loop that ingests data from external MCP tools and processes them as part of the LLM context. While this creates an attack surface for untrusted tool outputs, it is the standard and necessary behavior for testing tool-calling capabilities.
Audit Metadata