mcp-vercel
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install standard, well-known libraries:
mcp-handler(a Vercel utility),@modelcontextprotocol/sdk(the official MCP SDK), andzod(a schema validation library). These are legitimate dependencies for the stated purpose. - [COMMAND_EXECUTION]: Provides example shell commands for deployment (
vercel deploy --prod) and testing (curl). These are standard developer workflows. - [DYNAMIC_EXECUTION]: Includes a build-time utility script (
scripts/copy-deps.js) that performs filesystem operations (mkdirSync,readdirSync,copyFileSync) to manage dependencies within Vercel's root directory constraints. This is a common workaround for specific hosting environments and does not exhibit malicious patterns. - [INDIRECT_PROMPT_INJECTION]: The skill describes creating an API endpoint that processes external JSON-RPC requests. It mitigates risk by recommending
zodfor strict schema validation and parameter descriptions, which helps the agent understand and safely handle the data.
Audit Metadata