mcp-builder
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The evaluation harness in
scripts/evaluation.pyand the connection logic inscripts/connections.pyallow for the execution of local MCP servers using standard input/output (stdio). This is the intended functionality for local development and testing, where the specific command and arguments are supplied by the user during the execution of the script. - [INDIRECT_PROMPT_INJECTION]: The skill includes an evaluation system that processes test cases from external XML files. While this represents a data ingestion surface where instructions could theoretically be embedded, it is designed for developers to test their own implementations using trusted evaluation datasets. The agent is guided by a system prompt that uses XML-style boundary markers to separate summaries, feedback, and final responses.
- [EXTERNAL_DOWNLOADS]: The implementation guides and skill instructions provide links to official MCP documentation and SDK repositories within the
modelcontextprotocolorganization on GitHub. These references are used to fetch up-to-date protocol specifications and library documentation during the planning phase of server development.
Audit Metadata