mcp-setup
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several Bash scripts designed to detect existing configurations, create directories, and update JSON configuration files. These scripts use standard shell commands such as grep, cat, and mkdir to perform local setup tasks.
- [EXTERNAL_DOWNLOADS]: The generated configurations utilize npx to download and execute official MCP server packages from the npm registry (e.g., @modelcontextprotocol/server-github). These are standard dependencies for the Model Context Protocol and are provided by a well-known source.
- [DATA_EXPOSURE]: The skill interacts with the user's local configuration file at $HOME/.claude/config.json. This access is required for the skill's primary purpose. It also prompts the user for credentials (like GitHub tokens) to include them in the configuration, using silent input for security where appropriate.
Audit Metadata