mcp-gateway
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The StdioTransport implementation utilizes tokio::process::Command to spawn and manage local subprocesses. This is used in the configuration example to run the filesystem server.
- [EXTERNAL_DOWNLOADS]: The configuration demonstrates fetching and executing the @modelcontextprotocol/server-filesystem package via npx -y. While targeting a well-known organization, this pattern involves downloading and running code at runtime.
- [DATA_EXFILTRATION]: The HttpTransport, SseTransport, and WebSocketTransport implementations enable communication with remote URLs. These transports are designed to transmit authentication credentials (Bearer tokens and API keys) to the configured MCP server endpoints.
- [PROMPT_INJECTION]: The gateway's architecture for processing tool outputs from remote servers creates a surface for indirect prompt injection.
- Ingestion points: The skill reads and parses JSON-RPC responses from external HTTP, SSE, WebSocket, and Stdio sources.
- Boundary markers: No specific delimiters or safety instructions are shown to isolate tool output from the agent's control flow.
- Capability inventory: The gateway has the ability to spawn processes (StdioTransport) and perform network requests (multiple transports).
- Sanitization: The implementation focuses on transport logic and does not show explicit sanitization or validation of the content returned by external tools.
Audit Metadata