mcp-builder
Pass
Audited by Gen Agent Trust Hub on Feb 22, 2026
Risk Level: SAFE
Full Analysis
- [Dynamic Execution] (SAFE): The
MCPConnectionStdioclass facilitates communication with local MCP servers. While it involves process creation, it follows the standard MCP specification using the legitimatemcplibrary and does not contain hardcoded malicious commands.\n- [Unverifiable Dependencies & Remote Code Execution] (SAFE): Python requirements include only standard, reputable libraries (anthropic,mcp). No remote script execution or suspicious package installation patterns were detected.\n- [Data Exposure & Exfiltration] (SAFE): Transport classes for HTTP and SSE are provided for remote MCP server communication. The code does not attempt to access sensitive files (e.g., SSH keys, AWS credentials) or exfiltrate data to unauthorized domains.
Audit Metadata