chroma-core/chroma-mcp — agentic threat model

Not certain from the listing — The MCP server itself does not define the foundation model, but the downstream LLMs consuming retrieved documents are highly vulnerable to indirect prompt injection and adversarial reprogramming via poisoned vector embeddings.

This is the primary risk layer. The agent directly manages vector store operations (adding, embedding, and searching documents). It is highly vulnerable to data/knowledge-base poisoning, embedding inversion, and unauthorized data exfiltration if malicious documents are indexed.

The agent exposes tools for document insertion and similarity search. Insecure tool integration or lack of input sanitization on the document-addition tool allows upstream agents or users to inject malicious payloads into persistent memory.

Connects to both local and cloud Chroma instances. Risks include exposed database credentials, lack of transport encryption (TLS) to cloud instances, and potential lateral movement if the host running the MCP server is compromised.

Not certain from the listing — There is no mention of built-in guardrails, content filtering, or anomaly detection to flag poisoned embeddings or suspicious similarity search queries before they reach the LLM.

Not certain from the listing — The description does not detail authentication or authorization mechanisms (such as RBAC) governing who can write to or query the Chroma instances via this MCP server.

As an MCP tool, this agent is designed to be called by other orchestrator agents. A compromised or rogue upstream agent could abuse this tool to systematically exfiltrate the entire vector database or overwrite critical memory segments.