mcporter

Warn

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill enables the execution of arbitrary local shell commands and scripts via the --stdio flag.
  • Evidence: mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com in SKILL.md.
  • [COMMAND_EXECUTION]: The skill provides commands to start and manage persistent background processes (daemons), which allows tasks to remain active across sessions.
  • Evidence: mcporter daemon start|status|stop|restart in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the mcporter package from the Node.js package registry (npm) during setup.
  • Evidence: install metadata field in SKILL.md.
  • [REMOTE_CODE_EXECUTION]: The CLI facilitates calling and interacting with remote MCP tools directly via URL, which involves executing logic defined by external servers.
  • Evidence: mcporter call https://api.example.com/mcp.fetch url:https://example.com in SKILL.md.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 9, 2026, 10:45 PM
Security Audit — agent-trust-hub — mcporter