mcp-builder

Pass

Audited by Gen Agent Trust Hub on Feb 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The evaluation.py script is designed to execute local commands provided via the -c/--command and -a/--args CLI flags. This is used to launch and test local MCP server implementations during development. The execution is managed through the stdio transport using the official mcp library.
  • [EXTERNAL_DOWNLOADS]: The skill guides the user to fetch documentation, sitemaps, and README files from official Model Context Protocol sources, including modelcontextprotocol.io and the modelcontextprotocol organization on GitHub. These are well-known and trusted sources for this technology.
  • [INDIRECT_PROMPT_INJECTION]: The evaluation harness processes user-provided questions from XML files and passes them to an LLM alongside tool outputs. This represents an inherent attack surface for developer tools that process external data, though it is consistent with the tool's primary purpose as a test runner.
  • [DYNAMIC_EXECUTION]: The connections.py script dynamically creates process contexts for stdio communication based on user configuration. This is a standard requirement for interacting with local Model Context Protocol servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 27, 2026, 11:11 PM