mcp-oauth
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides boilerplate code for implementing a standard OAuth 2.0 PKCE flow. It correctly uses PKCE (Proof Key for Code Exchange) to mitigate authorization code injection and follows standard web security practices like CORS handling and hostname-based redirect URI validation.
- [SAFE]: The skill recommends using secure environment variables (e.g.,
process.env.KV_REST_API_TOKEN) for secret management rather than hardcoding credentials. - [SAFE]: All external references, such as the developer's GitHub repository and reputable platforms like Upstash, Vercel, and Claude.ai, are appropriate for the skill's context and intended use-case.
Audit Metadata