mcp-builder

This module does not show explicit malicious payload behavior (no obfuscated code, no credential theft, no direct system command execution). However, it implements an agent-style capability pathway where untrusted model output directly drives arbitrary MCP tool calls (tool_name/tool_input are not validated/allowlisted in this module). Tool results and even tracebacks are fed back into the LLM context, increasing the chance of unintended actions or information leakage if MCP tools have sensitive capabilities. Risk level is therefore driven by tool/connection permissions and sandboxing outside this fragment.