Atlas / MCP servers / genkit-ai / Genkit

GenkitBLOCK

Name: Genkit
Author: genkit-ai

mcp/genkit-ai/genkit

MCP server by genkit-ai · agents · ai · embedders · Audited 2026-10-12

Open-source framework for building agentic apps in JavaScript, Go, Dart, and Python, built and used in production by Google

Verdict

BLOCK

Grade

Trust score

30 /100

Exposed tools

161 146r · 14w · 1d

Transport

sse · stdio · streamable-http

License

Apache-2.0

Stars

6,509

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Genkit is an open-source framework for building full-stack AI-powered applications, built and used in production by Google's Firebase. It provides SDKs for multiple programming languages with varying levels of stability:

JavaScript/TypeScript: Production-ready with full feature support
Go: Production-ready with full feature support
Python (Beta): Wide feature support approaching production-readiness
Dart (Preview): Early development with core functionality

It offers a unified interface for integrating AI models from providers like Google, OpenAI, Anthropic, Ollama, and more. Rapidly build and deploy production-ready chatbots, automations, and recommendation systems using streamlined APIs for multimodal content, structured outputs, tool calling, and agentic workflows.

Building with a coding agent? Install the Genkit skill first. ``bash npx skills add genkit-ai/skills --skill developing-genkit-js # JavaScript/TypeScript npx skills add genkit-ai/skills --skill developing-genkit-go # Go npx skills add genkit-ai/skills --skill developing-genkit-python # Python npx skills add genkit-ai/skills --skill developing-genkit-dart # Dart `` It teaches your agent the current Genkit APIs and common gotchas. Source and manual install: genkit-ai/skills.

Get started with just a few lines of code:

import { genkit } from 'genkit';
import { googleAI } from '@genkit-ai/google-genai';

const ai = genkit({ plugins: [googleAI()] });

const { text } = await ai.generate({
model: googleAI.model('g

Read from source at commit 18602687113aOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add test_js_app --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CUSTOM_KEY=${CUSTOM_KEY} --env DB_PASSWORD=${DB_PASSWORD} --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "test_js_app": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "CUSTOM_KEY": "${CUSTOM_KEY}",
        "DB_PASSWORD": "${DB_PASSWORD}",
        "DEEPSEEK_API_KEY": "${DEEPSEEK_API_KEY}"
      }
    }
  }
}

Exposed tools (161)

146 read · 14 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Bulbasaur`	read	A Grass/Poison-type Pokemon that grows into a powerful Venusaur.
`Button`	read	A clickable button that fires an action back to the agent.
`Card`	read	A visually-contained card wrapping a single child.
`Charmander`	read	A Fire-type Pokemon that evolves into the powerful Charizard.
`CheckBox`	read	A labeled checkbox.
`Column`	read	Lays out children vertically.
`Divider`	read	A horizontal or vertical separator line.
`Icon`	read	Displays a named material icon.
`Image`	read	Displays an image from a URL.
`Jigglypuff`	read	A Normal/Fairy-type Pokemon with a hypnotic singing ability.
`List`	read	A list of children.
`Pikachu`	read	An Electric-type Pokemon known for its strong electric attacks.
`Row`	read	Lays out children horizontally.
`Slider`	read	A numeric slider.
`Squirtle`	read	A Water-type Pokemon known for its water-based attacks and high defense.
`Text`	write	Displays a run of text. For headings/titles set the
`TextField`	read	A single- or multi-line text input.
`Widget`	read	A widget.
`a2ui`	read	Adds A2UI (Agent-to-UI) streaming UI support: injects catalog
`add`	write	add two numbers together
`addTask`	write	Add a new task to the task list. Returns the newly created task.
`agents`	read	Injects per-agent delegation tools for calling registered sub-agents.
`artifacts`	read	Provides read_artifact and write_artifact tools for interacting
`askQuestion`	read	use this to ask the user a clarifying question
`ask_user`	read	Ask the user a question when you need clarification, a preference,
`badSchemaTool`	read	A tool with an invalid schema type
`bad_tool`	read	a tool
`bad_tool_approved`	read	a tool
`catalogAgent`	read	Catalog Agent can help customers browse and search products
`coder`	read	Writes TypeScript code
`codingAgent`	write	An expert AI coding assistant that can read, create, edit files,
`confirmAction`	read	needs human confirmation
`confirmBooking`	read	Confirm with the user before booking a dish.
`contextCompression`	read	Compresses conversation context when it grows too large, using
`dailySpecial`	read	Get today
`dangerousTool`	read	A tool that requires confirmation
`dapJokeTool`	read	DAP joke tool
`datePicker`	read	user can use this UI tool to enter a date (prefer this over asking the user to enter the date manually)
`dynamic`	read	dynamic interrupt
`dynamicInterrupt`	read	description
`dynamic_preserve`	read	test
`dynamic_restartable`	read	test
`echoTool`	read	echo
`fallback`	read	Fallback to a different model on specific error statuses.
`fallbackTool`	read	a tool with fallback output
`fetchCatalog`	read	Fetches the complete product catalog with all available items
`fetchMostPopularItems`	read	Fetches the most popular items in the catalog (top 3)
`fetchReport`	read	Retrieves the detailed text and metrics for a specific report ID.
`filesystem`	read	Injects tools for reading, writing, and searching files in a directory.
`foo`	read	tool foo
`fooz`	read	gets fooz
`gablorken`	read	calculates a gablorken
`gablorkenTool`	read	use when need to calculate a gablorken
`getAttractions`	read	Get popular tourist attractions for a given city.
`getCharacterName`	read	Gives the name of a main character
`getColor`	read	gets a random color
`getExchangeRate`	write	Look up the current exchange rate for an international transfer.
`getFlightInfo`	read	Get mock flight information between two cities on a given date.
`getProductDetails`	read	Get detailed information about a specific product by ID
`getRecentGrades`	read	retrieves recent grades for a specific student
`getRecentScores`	read	Returns a list of recent numeric game scores for a player
`getSomeMarkdown`	read	Gets some markdown formatted text to display on the UI.
`getSomePreformattedText`	read	Gets some pre-formatted text to display on the UI.
`getStoreInfo`	read	Get store information including hours, location, and contact details
`getTime`	read	Get the current time
`getWeather`	read	Get current weather
`get_current_weather`	read	gets weather
`get_trace`	read
`get_usage_guide`	read
`get_weather`	read	Returns the weather
`good_tool`	read	a tool
`happy`	read	everybody together now
`heavyTool`	read	returns large data
`hugeTool`	read	returns large data
`injectedTool`	read	desc
`interruptTool`	read	An interrupt tool
`interrupter`	read	always interrupts
`interruptingTool`	read	description
`jokeSubjectGenerator`	read	can be called to generate a subject for a joke
`listMyOrders`	read	Lists the signed-in user
`list_flows`	read
`list_genkit_docs`	read
`lookup`	read	look something up
`lookupUsers`	read	use this tool to list users
`main.rs`	read	Primary application entry point
`menuLookupTool`	read	use this tool to look up the menu for a given date
`middlewareTool`	read	injected by middleware
`mockTool`	read	A mock tool
`multiTool`	read	a tool with multiple parts
`multipart`	read	test
`mw1`	read	test mw1
`myFunc`	read	desc
`myInterrupt`	read	Ask user
`my_tool`	read	a tool
`myagent`	read	Registry description (should be overridden).
`needs_approval`	read	Requires human approval before proceeding.
`processPayment`	write	Process a payment for an order
`read_artifact`	read	Reads the content of a named artifact from the session.
`read_genkit_docs`	read
`realInterrupt`	read	A real interrupt
`registered`	read	registered interrupt
`regular`	read	test
`regularAction`	read	test
`removeTask`	destructive	Remove a task from the list by its ID.
`reportAbsence`	read	use this tool to mark a specific student as absent on one or more days
`reportTardy`	read	use this tool to mark a specific student tardy for a given date
`researcher`	read	A thorough research assistant that searches the web and provides well-sourced answers.
`reservationTool`	read	use this tool to try to book a reservation
`restartTool`	read	A tool that requires confirmation before executing
`resumable`	read	interrupts unless resumed with {status:
`resumableTool`	read	description
`retry`	write	Retries a request a specified number of times when a specific set of errors occurs
`riskyAction`	write	Performs an action that must be confirmed via restart
`routingAgent`	read	This agent helps with answering inquiries and requests.
`run_flow`	write
`run_shell`	write	Execute a shell command in the workspace directory. Use for running
`search`	read	search tool
`searchCatalog`	read	Search for products by name, category, or keyword
`searchEvents`	read	use this when asked about any time/location for school events including extra curriculars like clubs
`searchReports`	read	Searches for document and incident report IDs related to a topic.
`search_genkit_docs`	read
`sensitiveTool`	read	Tool with sensitive inputs
`simple`	read	simple interrupt
`simple2`	read	simple2
`simpleTool`	read	description
`skills`	read	Injects system instructions and tools for using skills.
`smartagent`	read	A very smart agent that knows everything.
`someListFilesTool`	read	Lists files
`someTool`	read	hello world
`start_runtime`	write
`step`	read	step
`summarize_weather`	read	Summarizes a forecast
`tellAFunnyJoke`	read	Tells jokes about an input topic. Use this tool whenever user asks you to tell a joke.
`tellAJoke`	read	Tell a joke
`test`	read	test
`testAction`	read	A test action
`testMediaTool`	read	A tool for testing audio and resource links
`testMultipartTool`	read	A tool for testing multipart
`testStructuredTool`	read	A tool for testing structured content
`testTool`	read	A simple test tool
`test_http`	read
`test_meta`	read	test
`test_no_meta`	read	test
`test_preserve`	read	test
`test_restartable`	read	test
`todaysMenu`	read	Use this tool to retrieve all the items on today
`toggleTask`	read	Toggle a task between done and not-done by its ID. Returns the updated task or an error message.
`toolA`	read	toolA descr
`toolApproval`	read	Interrupts tool execution unless the tool is in the approved list or approved via metadata.
`toolB`	read	toolB it is
`transferMoney`	write	Transfer money to a specified account.
`transferToAgent`	write	Call this to transfer conversation control to a different specialist agent.
`triageAgent`	read	Triage Agent
`truth`	read	always returns true
`upcomingHolidays`	read	can retrieve information about upcoming holidays
`use_skill`	read	Use a skill by its name.
`userApproval`	read	Ask the user for approval before proceeding with a sensitive action.
`weather`	read	Get the weather for a city
`weatherTool`	read	use this tool to display weather
`whoami`	read	returns the caller uid
`write_artifact`	write	Creates or updates a named artifact in the session.

Trust audit

BLOCKgrade F · trust 30/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (6 observation(s))
Shell: declared (4 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

js/core/src/tracing.ts:67

const importModule = new Function(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

py/packages/genkit-amazon-bedrock/src/genkit_amazon_bedrock/_transport.py:52

'AWS_DEFAULT_REGION, or a region in ~/.aws/config'

Why it matters. touches a credential store

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

js/testapps/model-armor/README.md:5

prompt injection, jailbreak attempts, and sensitive data before sending

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

js/testapps/model-armor/README.md:12

| Content Filtering | `modelArmorFlow` | Generation with Model Armor middleware for PI/jailbreak and SDP filters |

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

js/testapps/model-armor/README.md:65

- Error details include the specific filter that triggered (PI/jailbreak, SDP)

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

genkit-tools/cli/src/commands/dev-test-model.ts:69

'iVBORw0KGgoAAAANSUhEUgAAByIAAAGdCAYAAABel7RVAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAADv9SURBVHgB7d1bchPn9jfgF58qdx97BH9xquIuMIKYEQRGgBkBZgSYEQAjwIwAMgKcEcS5SxXY1h7BZt+lbGy

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

js/ai/src/testing/model-tester.ts:47

url: 'data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAABhGlDQ1BJQ0MgcHJvZmlsZQAAKJF9kT1Iw0AcxV9TpSoVETOIOGSoulgQFXHUKhShQqgVWnUwufRDaNKQtLg4Cq4FBz8Wqw4uzro6uAqC4AeIs4OToouU+L+k0CL

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

py/packages/genkit/tests/genkit/ai/generate_test.py:3974

raise RuntimeError('connection to postgres://user:pw@host refused')

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

go/plugins/googlegenai/README.md:86

APIKey: "your-express-mode-api-key", // Optional: defaults to VERTEX_API_KEY, GOOGLE_API_KEY, or GOOGLE_GENAI_API_KEY

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

js/plugins/google-genai/tests/vertexai/gemini_test.ts:65

apiKey: 'test-express-api-key',

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

js/plugins/google-genai/tests/vertexai/index_test.ts:65

apiKey: 'test-express-api-key',

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

py/packages/genkit-otel/tests/genai_instrumentation_test.py:864

secret = 'allergy-peanut-table-4'

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

js/plugins/google-cloud/tests/logs_no_input_output_test.ts:51

private_key: '-----BEGIN PRIVATE KEY-----',

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

js/plugins/google-cloud/tests/logs_test.ts:54

private_key: '-----BEGIN PRIVATE KEY-----',

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

js/plugins/google-cloud/tests/metrics_test.ts:59

private_key: '-----BEGIN PRIVATE KEY-----',

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

js/plugins/google-cloud/tests/traces_test.ts:52

private_key: '-----BEGIN PRIVATE KEY-----',

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

removeTask

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierrc.yaml

.prettierrc.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

py/.pysentry.toml

.pysentry.toml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

.github/workflows/python-samples.yml:110

importlib.import_module(mod)

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

.github/workflows/python-samples.yml:166

importlib.import_module(mod)

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

py/packages/genkit/tests/genkit/ai/flow_signature_test.py:184

exec(_TYPE_CHECKING_CONTEXT_MODULE, module_globals)  # noqa: S102 - builds a module with postponed annotations

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

py/packages/genkit/tests/genkit/ai/flow_signature_test.py:206

exec(source, module_globals)  # noqa: S102 - builds a module whose annotations are evaluated lazily

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

py/packages/genkit/tests/genkit/ai/model_definition_contract_test.py:150

exec(source, module_globals)  # noqa: S102 - builds a user module

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 18602687113afull audit observations/trust-audit/mcp-server/genkit-ai__genkit.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`18602687113a`	BLOCK	F	30	first audit

Questions

What is the @genkit-ai/mcp MCP server?

Open-source framework for building agentic apps in JavaScript, Go, Dart, and Python, built and used in production by Google

What tools does @genkit-ai/mcp expose?

161 in total: 146 read-only, 14 that write, and 1 that can delete or overwrite (removeTask). Every one is listed on this page with its risk.

Is @genkit-ai/mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (30/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does @genkit-ai/mcp need?

It reads ANTHROPIC_API_KEY, CUSTOM_KEY, DB_PASSWORD, DEEPSEEK_API_KEY, DJANGO_SECRET_KEY, GEMINI_API_KEY, GENKIT_REFLECTION_SECRET_TOKEN, GOOGLE_API_KEY, GOOGLE_GENAI_API_KEY, OPENAI_API_KEY, PINECONE_API_KEY and VERTEX_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @genkit-ai/mcp run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as test_js_app at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (18602687113a), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	genkit-ai/genkit
npm	`test_js_app@1.0.0`
PyPI	`vertexai-image`
Transports	sse · stdio · streamable-http
Credentials it reads	`ANTHROPIC_API_KEYCUSTOM_KEYDB_PASSWORDDEEPSEEK_API_KEYDJANGO_SECRET_KEYGEMINI_API_KEYGENKIT_REFLECTION_SECRET_TOKENGOOGLE_API_KEYGOOGLE_GENAI_API_KEYOPENAI_API_KEYPINECONE_API_KEYVERTEX_API_KEY`
License	Apache-2.0
Activity	pushed 0d ago