Academic Search MCP — agentic threat model

Not certain from the listing — The underlying foundation model is not specified. However, the primary L1 threat is indirect prompt injection, where malicious instructions embedded in academic paper abstracts or metadata reprogram the model's behavior during processing.

The agent ingests external, untrusted data from the Semantic Scholar API (metadata, abstracts, citation graphs). This introduces a risk of data poisoning or formatting exploits if the retrieved content contains malicious payloads designed to exploit parser vulnerabilities or manipulate downstream agent logic.

The agent uses the Model Context Protocol (MCP) to expose search and recommendation tools. Threats include insecure tool integration, lack of input validation on search queries, and potential resource exhaustion during batch metadata retrieval operations.

Not certain from the listing — The hosting and deployment environment of the MCP server is not detailed. The primary infrastructure threat is the exposure or theft of the Semantic Scholar API key if it is insecurely stored in environment variables or configuration files.

Not certain from the listing — There is no mention of logging, monitoring, or guardrails. The lack of observability could lead to blind spots, preventing the detection of anomalous search patterns or successful indirect prompt injection attacks.

Not certain from the listing — No authentication, authorization, or compliance frameworks are specified. Without access controls, unauthorized clients could abuse the MCP server, potentially exhausting the Semantic Scholar API rate limits or quotas.

As an MCP tool, this agent is designed to integrate into broader agentic ecosystems. A compromised or manipulated search result could lead to cascading failures or trust abuse if other orchestrator agents consume its output without sanitization.