mcp-builder

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The evaluation harness in scripts/evaluation.py and scripts/connections.py allows developers to launch and test local MCP servers using standard input/output (stdio). This process is initiated by the user via command-line arguments and is the intended core functionality of the testing suite.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch official documentation and SDKs from well-known and trusted sources, specifically the official Model Context Protocol website and its verified GitHub repositories.
  • [CREDENTIALS_UNSAFE]: Security best practices are followed for API authentication. The documentation explicitly directs users to set the ANTHROPIC_API_KEY as an environment variable rather than hardcoding it into scripts or configuration files.
  • [DATA_EXFILTRATION]: Network activity is limited to authorized operations: sending evaluation questions to the Anthropic API and connecting to developer-specified MCP server endpoints (local or remote).
  • [PROMPT_INJECTION]: No malicious prompt injection patterns or attempts to bypass safety filters were detected in the instructions or scripts.
  • [SAFE]: No signs of obfuscation, unauthorized persistence mechanisms, or privilege escalation attempts were found. The skill is consistent with its stated purpose as a developer productivity tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 02:18 AM