mcp-builder
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation and SDK guidelines from official Model Context Protocol sources (modelcontextprotocol.io) and their public GitHub repositories. These are recognized, well-known technology organizations and services.
- [COMMAND_EXECUTION]: The evaluation script (
scripts/evaluation.py) is designed to run local MCP servers for testing purposes via standard I/O. This is a standard development workflow for testing local code and is used within the intended scope of the skill's purpose as a developer tool. - [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential management practices. The evaluation harness and documentation explicitly instruct users to provide API keys via environment variables or command-line arguments rather than hardcoding them.
- [DATA_EXFILTRATION]: Network operations are limited to communicating with the Anthropic API (for the evaluation harness) and fetching documentation from trusted sources. No patterns of sensitive data exfiltration were detected.
Audit Metadata