analytics-mcp-server — agentic threat model

Not certain from the listing — The underlying LLM is not specified as this is an MCP server. The primary threat is model reprogramming or prompt injection via malicious database schemas or imported CSV content that forces the model to generate unsafe queries.

Data operations are restricted to local SQLite databases and CSV imports. The primary risk is data poisoning via untrusted CSV files, which could lead to SQL injection or downstream prompt injection when the agent reads the imported data.

The framework provides schema inspection, aggregations, and guarded read-only queries. The main threat is a breakdown in the guard layer, allowing an attacker to bypass read-only restrictions or execute arbitrary SQL commands via injection.

Deployment is local-only, which significantly reduces the network attack surface. However, if the host environment is compromised, the SQLite database files and local CSV files are exposed to unauthorized access.

Not certain from the listing — There is no mention of built-in logging, auditing, or evaluation guardrails beyond the query guard layer. Monitoring of executed SQL queries and import actions is highly recommended.

The agent implements a security policy of 'guarded read-only queries' to enforce read-only access, but lacks robust identity, authentication, or authorization mechanisms of its own, relying instead on host-level permissions.

As an MCP server, it is designed to interact with an orchestrating client or agent. The threat of cascading failures exists if a compromised parent agent abuses the analytics tools to extract sensitive local data.