configuring-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The utility script
scripts/test-mcp-connection.jsuseschild_process.spawnto execute commands defined in the user's local MCP configuration files (e.g.,~/.config/claude/mcp.json). This functionality is intended to allow users to verify that their configured MCP servers are operational and correctly responding to initialization requests. - [EXTERNAL_DOWNLOADS]: The documentation and configuration templates reference official MCP server packages maintained by the Model Context Protocol organization (e.g.,
@modelcontextprotocol/server-filesystem,@modelcontextprotocol/server-github) and other well-known services. These references are used to guide the user in setting up standard integrations. - [CREDENTIALS_UNSAFE]: While the skill contains examples of API tokens and database connection strings (e.g.,
ghp_xxx,postgresql://user:pass@localhost:5432/db), these are clearly marked as placeholders or illustrative examples. The skill explicitly instructs users to manage real credentials securely using environment variables and.envfiles rather than hardcoding them in configuration files.
Audit Metadata