mcporter-setup

Pass

Audited by Gen Agent Trust Hub on Apr 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/check-install.ts automatically installs the mcporter utility using global package managers such as npm or pnpm if the tool is not detected in the environment. This is a standard setup procedure for this skill's functionality.
  • [COMMAND_EXECUTION]: The skill uses Bun.spawnSync in multiple scripts (add-server.ts, test-server.ts, check-install.ts) to invoke shell commands for installing packages and configuring MCP servers via the mcporter CLI.
  • [CREDENTIALS_UNSAFE]: The skill provides guidance for setting up authenticated servers such as Linear and GitHub. It correctly instructs the user to store credentials like LINEAR_API_KEY or GITHUB_TOKEN in the platform's advanced secrets storage rather than hardcoding them in the configuration.
  • [DATA_EXFILTRATION]: The scripts/detect-auth.ts script performs outbound network requests using fetch to analyze remote server endpoints. These requests are used to determine supported authentication methods (OAuth, Bearer, etc.) and protocol compatibility, which is consistent with the skill's purpose as a setup utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 12, 2026, 07:32 AM