Astra DB — agentic threat model

Not certain from the listing — Astra DB MCP is model-agnostic and does not specify a foundation model. However, the underlying LLM calling these tools is highly vulnerable to prompt injection, which can force the model to execute unauthorized database commands.

Directly exposes the vector database and document store. Threats include data poisoning via malicious document insertion, bulk data exfiltration through search tools, and embedding inversion if vector data is accessed.

The MCP framework orchestrates tool calling for CRUD and bulk operations. Vulnerabilities include tool misuse (e.g., an agent executing a bulk delete instead of a find) and memory poisoning if the agent stores malicious payloads retrieved from the database.

Not certain from the listing — The hosting environment of the MCP server and the client agent is unspecified. However, exposure of the Astra token in the environment or memory poses a severe credential theft risk.

Not certain from the listing — No built-in guardrails, logging, or anomaly detection are mentioned. Without strict observability, malicious bulk operations or unauthorized data harvesting could go undetected.

Relies on Astra token authentication for access control. However, if the token is over-privileged, the agent inherits full read/write/delete access to the entire database without granular, user-level authorization checks.

In a multi-agent ecosystem, any agent with access to this MCP server can read or modify database state, leading to cascading data corruption if a compromised upstream agent passes malicious instructions.