mcp-setup
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates the setup of external tools by executing system commands. It uses 'claude mcp add' for server registration, 'npx' for Node.js-based servers, and 'docker run' for the GitHub MCP implementation. It also allows for arbitrary user-defined commands through the 'Custom' server option.
- [EXTERNAL_DOWNLOADS]: The skill retrieves software from well-known registries and official repositories. This includes downloading packages from the npm registry (such as '@upstash/context7-mcp', 'exa-mcp-server', and '@modelcontextprotocol/server-filesystem') and pulling a container image from the GitHub Container Registry ('ghcr.io/github/github-mcp-server').
- [CREDENTIALS_UNSAFE]: The skill handles sensitive configuration data by prompting the user for an Exa API key and a GitHub Personal Access Token. These credentials are provided by the user and then used as environment variables within the setup commands to enable service access.
Audit Metadata