mcp-server-auth
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The diagnostic script probes external endpoints, creating a surface for indirect prompt injection via server responses.\n
- Ingestion points: Server responses and metadata endpoints fetched in
scripts/check_auth_endpoints.py.\n - Boundary markers: None used in the script's output reporting.\n
- Capability inventory: Network read operations using
urllib.requestand stdout reporting.\n - Sanitization: Content from remote JSON responses is parsed and reported without sanitization.\n- [EXTERNAL_DOWNLOADS]: The skill recommends using the official
@modelcontextprotocol/conformancepackage from npm, which is a recognized tool for protocol verification.\n- [COMMAND_EXECUTION]: Thescripts/check_auth_endpoints.pyscript includes an optional--insecurecommand-line argument that disables SSL certificate validation for local development and debugging.
Audit Metadata