mcp-builder
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/connections.pyandscripts/evaluation.pyscripts implement a stdio transport mechanism that uses subprocesses to launch and interact with local MCP server binaries or scripts provided by the user via CLI arguments. - [REMOTE_CODE_EXECUTION]: The
scripts/evaluation.pyharness executes an agentic loop using the Anthropic API to dynamically call tools on local or remote MCP servers. The tools called are determined at runtime by the AI model based on the provided test questions. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdfile directs the agent to fetch documentation, sitemaps, and SDK README files from the officialmodelcontextprotocolGitHub repositories and website to aid in the development process. - [PROMPT_INJECTION]: The
scripts/evaluation.pyscript possesses an indirect prompt injection surface by ingesting untrusted tool outputs directly into the agent's context. Evidence: 1. Ingestion points: MCP tool results within the agent loop; 2. Boundary markers: The system prompt uses XML tags (<summary>,<feedback>,<response>) to structure agent output; 3. Capability inventory: The harness allows for tool execution and subprocess command execution; 4. Sanitization: No specific filtering or sanitization of tool outputs is performed before they are passed to the model.
Audit Metadata