fastmcp
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate templates and documentation for the FastMCP framework. All included bash scripts are limited to environment validation, deployment readiness checks, and local testing of the developer's own server code.
- [COMMAND_EXECUTION]: Contains reference documentation (references/cli-commands.md) that instructs the developer on how to use standard system tools like lsof and kill to manage local process ports. These are user-facing instructions and are not executed automatically by the skill.
- [DYNAMIC_EXECUTION]: Features templates demonstrating the automatic generation of MCP tools from OpenAPI specifications. This is an intended, documented feature of the FastMCP library for streamlining API integration and does not involve executing untrusted remote code.
- [INDIRECT_PROMPT_INJECTION]: As a framework for building tools that ingest external data, the skill correctly provides patterns for mitigating injection attacks using Pydantic for strict input validation and type enforcement.
Audit Metadata