mapbox-mcp-runtime-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download the @mapbox/mcp-server package via npx and install various agent framework dependencies from the NPM and PyPI registries. These resources originate from the vendor or trusted organizations.
- [COMMAND_EXECUTION]: Code snippets demonstrate the use of subprocess.Popen in Python and child_process.spawn in TypeScript to launch the Mapbox MCP server locally using npx. Standard package installation commands (pip, npm) are also documented.
- [DYNAMIC_EXECUTION]: Programmatic execution of the npx command is used to initialize the geospatial server environment at runtime within the agent's startup sequence.
- [INDIRECT_PROMPT_INJECTION]: The integration patterns describe agents that ingest user-provided search categories and location strings. \n- Ingestion points: User input is passed directly to agent execution methods like agent.run() or locationAgent.generate(). \n- Boundary markers: System prompts are utilized to define tool behavior, though the examples do not enforce strict data delimiters for user queries. \n- Capability inventory: The agents can perform network requests to the Mapbox API and execute local geometric calculations using Turf.js. \n- Sanitization: Tool parameters are validated using Zod schemas in TypeScript and Pydantic models in Python, which helps prevent malformed data from affecting tool logic.
Audit Metadata