building-mcp-servers

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow for this skill is the evaluation harness (scripts/evaluation.py) which sends the evaluation question and then repeatedly ingests tool_result content returned by the connected MCP server (connection.call_tool(...) → tool_response → appended into messages as tool_result), and that tool output can include outsider-authored free text from remote/public systems the MCP server fetches.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The evaluation harness connects at runtime to a user-specified MCP server URL (e.g., https://example.com/mcp) and fetches the server's tool definitions which are passed into the LLM as "tools", directly influencing the agent's behavior and are required for the evaluation to run.