mcp-oauth-remote-gateway
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes terminal commands and Python scripts to perform manual OAuth 2.1 handshakes, including the generation of PKCE code verifiers and challenges, and the writing of configuration files.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to external MCP servers and Authorization Servers to retrieve resource metadata, authorization configurations, and security tokens.
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON metadata from external MCP endpoints to identify authentication parameters. This establishes a surface for processing untrusted external data during the discovery phase of the OAuth flow.
Audit Metadata