mcp-builder

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The evaluation.py script and connections.py module are designed to launch and interact with local MCP servers. When using the stdio transport, the script executes commands provided by the user via command-line arguments (e.g., python my_mcp_server.py). This is the primary intended functionality of the evaluation harness, allowing developers to test the servers they are building in a local environment.
  • [EXTERNAL_DOWNLOADS]: The SKILL.md instructions and implementation guides recommend fetching official SDK documentation and protocol specifications from github.com/modelcontextprotocol. These references target a well-known and relevant service for the skill's domain.
  • [INDIRECT_PROMPT_INJECTION]: The evaluation loop in scripts/evaluation.py represents a potential surface for indirect prompt injection.
  • Ingestion points: The script reads test questions from user-provided XML files (e.g., evaluation.xml) and retrieves tool outputs from the MCP server being tested.
  • Boundary markers: The system prompt uses XML tags (<summary>, <feedback>, <response>) to structure the agent's output, which helps delimit different types of content.
  • Capability inventory: The script can execute local subprocesses (to run MCP servers) and perform network operations via the Anthropic API.
  • Sanitization: There is no explicit sanitization or filtering of the text content extracted from the XML evaluation files before it is interpolated into the prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 12:32 PM