Basic Memory — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP). The primary threat is model reprogramming or prompt injection when poisoned notes from the local markdown knowledge graph are recalled into the active context window.

The core of this agent is local RAG and semantic memory. The primary threats are data poisoning of the local markdown files (which can alter future agent behavior) and lack of input validation on files read from the user's knowledge base, potentially leading to path traversal or unauthorized file access.

The agent framework manages bidirectional note linking and persistent state. Memory poisoning is a critical threat here, as malicious or malformed notes can corrupt the semantic graph, leading to logic bypasses or unexpected tool execution in the orchestrating framework.

The agent runs locally as an MCP tool, reading and writing directly to the host disk. The main threat is directory traversal or arbitrary file write/read if the agent does not strictly sandbox its file operations to a designated workspace directory.

Not certain from the listing — There is no mention of built-in guardrails, logging, or anomaly detection to identify when poisoned notes are being injected into the knowledge graph or when unauthorized file paths are accessed.

Not certain from the listing — The tool relies on the host environment's file permissions for access control. There are no explicit authentication or authorization mechanisms described to restrict which client applications or agents can read/write to the knowledge graph.

As an MCP tool, this agent is designed to be called by other agents. A compromised or malicious upstream agent could abuse this tool to exfiltrate sensitive local files or write malicious payloads into the user's persistent knowledge base.