Apollo (Composio MCP) — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP). The primary risk is indirect prompt injection where malicious data retrieved from Apollo's search results influences the model's subsequent instructions.

The agent acts as a conduit for bulk PII (emails, phone numbers, company data). Risks include data exfiltration, scraping of proprietary contact databases, and violation of privacy regulations (GDPR/CCPA) through automated querying.

Utilizes Composio's MCP framework to expose Apollo API tools. Vulnerabilities include insecure tool integration where an LLM can be manipulated into executing unauthorized bulk searches or exhausting API quotas.

Composio manages the authentication and hosts the connection. The primary risk is the exposure or leakage of the managed Apollo API key or Composio integration tokens.

Not certain from the listing — There is no mention of built-in rate limiting, anomaly detection for bulk queries, or logging of LLM-to-tool interactions to prevent automated harvesting of contact records.

Composio handles authentication, which provides some centralized access control. However, compliance risks remain high due to the ease of extracting and processing PII without explicit user consent or audit trails.

As an MCP tool, this agent can be chained with other agents (e.g., auto-dialers or email spammers), creating cascading risks where compromised upstream agents abuse Apollo tools for targeted social engineering.