truefoundry-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructions include explicit security policies and defensive prompts that instruct the agent to reject raw credentials and require human-in-the-loop confirmation for deletions and external URL usage. These measures are designed to enhance the safety of the agent's operations.
- [DATA_EXFILTRATION]: The
scripts/tfy-api.shhelper script reads API keys and configuration from environment variables or a local.envfile for authentication. This data is used solely to interact with the user-configured TrueFoundry platform endpoint and does not involve unauthorized data transmission to third-party domains. - [COMMAND_EXECUTION]: The skill utilizes the
bashenvironment to execute thetfy-api.shscript (a wrapper forcurl) and thetfyCLI. These commands are necessary for the skill's primary function of managing cloud resources and follow standard operational patterns for TrueFoundry tools. - [EXTERNAL_DOWNLOADS]: The skill documentation references pinned container images and packages from well-known registries such as AWS Public ECR, GitHub Container Registry (HuggingFace), and NVIDIA GPU Cloud (NGC). These references are part of standard configuration guidelines and do not involve unverified remote code execution.
Audit Metadata