mcp-builder

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/evaluation.py and scripts/connections.py files provide functionality to execute local commands via the stdio transport to launch MCP servers. This is an intended feature of the testing harness, allowing developers to run and test their server implementations as subprocesses.
  • [EXTERNAL_DOWNLOADS]: The documentation and guides within the skill reference official resources from the Model Context Protocol organization (modelcontextprotocol.io and github.com/modelcontextprotocol). These are well-known official sources for the protocol's SDKs and specifications.
  • [INDIRECT_PROMPT_INJECTION]: The scripts/evaluation.py script implements an autonomous agent loop that ingests data from external MCP tools and processes them as part of the LLM context. While this creates an attack surface for untrusted tool outputs, it is the standard and necessary behavior for testing tool-calling capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 10:53 PM