mcp-builder
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
evaluation.pyscript andconnections.pymodule are designed to launch and interact with local MCP servers. When using thestdiotransport, the script executes commands provided by the user via command-line arguments (e.g.,python my_mcp_server.py). This is the primary intended functionality of the evaluation harness, allowing developers to test the servers they are building in a local environment. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdinstructions and implementation guides recommend fetching official SDK documentation and protocol specifications fromgithub.com/modelcontextprotocol. These references target a well-known and relevant service for the skill's domain. - [INDIRECT_PROMPT_INJECTION]: The evaluation loop in
scripts/evaluation.pyrepresents a potential surface for indirect prompt injection. - Ingestion points: The script reads test questions from user-provided XML files (e.g.,
evaluation.xml) and retrieves tool outputs from the MCP server being tested. - Boundary markers: The system prompt uses XML tags (
<summary>,<feedback>,<response>) to structure the agent's output, which helps delimit different types of content. - Capability inventory: The script can execute local subprocesses (to run MCP servers) and perform network operations via the Anthropic API.
- Sanitization: There is no explicit sanitization or filtering of the text content extracted from the XML evaluation files before it is interpolated into the prompt.
Audit Metadata