mcp-builder
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/connections.pyandscripts/evaluation.pyfiles enable the execution of local MCP servers. When using thestdiotransport, the harness launches user-specified commands (e.g.,python server.py) as subprocesses. This is the standard mechanism for interacting with local MCP servers during development. - [EXTERNAL_DOWNLOADS]: The documentation within
SKILL.mdand reference files points to official Model Context Protocol resources onmodelcontextprotocol.ioand GitHub. These are used to fetch the latest protocol specifications and SDK documentation. The evaluation script also correctly connects to the Anthropic API to facilitate LLM-based testing. - [PROMPT_INJECTION]: The
scripts/evaluation.pyscript utilizes a system prompt to define the behavior of an evaluation agent. It handles user-provided questions from XML files. While this represents an indirect prompt injection surface, it is the intended functionality of the evaluation harness to test how an LLM handles various queries using the server's tools.
Audit Metadata