mcp-builder
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The evaluation harness in
scripts/evaluation.pyandscripts/connections.pyallows developers to launch and test local MCP servers using standard input/output (stdio). This process is initiated by the user via command-line arguments and is the intended core functionality of the testing suite. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch official documentation and SDKs from well-known and trusted sources, specifically the official Model Context Protocol website and its verified GitHub repositories.
- [CREDENTIALS_UNSAFE]: Security best practices are followed for API authentication. The documentation explicitly directs users to set the
ANTHROPIC_API_KEYas an environment variable rather than hardcoding it into scripts or configuration files. - [DATA_EXFILTRATION]: Network activity is limited to authorized operations: sending evaluation questions to the Anthropic API and connecting to developer-specified MCP server endpoints (local or remote).
- [PROMPT_INJECTION]: No malicious prompt injection patterns or attempts to bypass safety filters were detected in the instructions or scripts.
- [SAFE]: No signs of obfuscation, unauthorized persistence mechanisms, or privilege escalation attempts were found. The skill is consistent with its stated purpose as a developer productivity tool.
Audit Metadata