shiftcare-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and official URLs for regional ShiftCare MCP servers (AU, UK, US, CA) to facilitate integration.
- [SAFE]: Authentication is handled via OAuth through a browser login, and the skill explicitly instructs users never to store credentials in configuration files or environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to read external data (rostering, client, and staff data) which could contain malicious instructions from untrusted users. This is an inherent risk of the tool's primary purpose and is managed by platform guardrails.
Audit Metadata