mcporter-setup
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/check-install.tsautomatically installs themcporterutility using global package managers such asnpmorpnpmif the tool is not detected in the environment. This is a standard setup procedure for this skill's functionality. - [COMMAND_EXECUTION]: The skill uses
Bun.spawnSyncin multiple scripts (add-server.ts,test-server.ts,check-install.ts) to invoke shell commands for installing packages and configuring MCP servers via themcporterCLI. - [CREDENTIALS_UNSAFE]: The skill provides guidance for setting up authenticated servers such as Linear and GitHub. It correctly instructs the user to store credentials like
LINEAR_API_KEYorGITHUB_TOKENin the platform's advanced secrets storage rather than hardcoding them in the configuration. - [DATA_EXFILTRATION]: The
scripts/detect-auth.tsscript performs outbound network requests usingfetchto analyze remote server endpoints. These requests are used to determine supported authentication methods (OAuth, Bearer, etc.) and protocol compatibility, which is consistent with the skill's purpose as a setup utility.
Audit Metadata