mcp-visual-output
Pass
Audited by Gen Agent Trust Hub on May 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides guidance on using a structured visual rendering framework for MCP tools. It uses a typed JSON specification (defined via Zod) rather than allowing the AI to generate arbitrary HTML or CSS, which prevents traditional XSS and injection attacks.
- [EXTERNAL_DOWNLOADS]: The documentation references standard npm packages including @json-render/mcp, @json-render/core, @json-render/react, and the Model Context Protocol SDK. These are legitimate dependencies for the framework's ecosystem.
- [SAFE]: The
rules/sandbox-csp.mdfile provides explicit security instructions for implementing Content Security Policies (CSP). It advises developers to use minimal domain declarations and avoid 'unsafe-inline' or wildcard origins, which are critical for preventing data exfiltration and unauthorized script execution. - [SAFE]: The architectural pattern described relies on sandboxed iframes where the rendering logic is inlined in a single HTML bundle, further reducing the attack surface by minimizing external resource requirements at runtime.
Audit Metadata