Clerk MCP Server — agentic threat model

Not certain from the listing — the MCP server itself does not host a foundation model, but acts as a utility for external LLMs. The primary risk is the host LLM executing adversarial instructions embedded in retrieved documentation snippets.

The core function is fetching Clerk auth docs and SDK snippets. The primary threat is data poisoning of the source documentation or man-in-the-middle attacks altering the retrieved snippets, leading to insecure code generation.

Integrates via the Model Context Protocol (MCP). Vulnerabilities include insecure tool integration where the calling agent treats the fetched documentation as implicitly trusted, executable context.

Not certain from the listing — details about the hosting environment of the remote MCP server are omitted. Risks include exposed API endpoints and lack of transport layer security during document retrieval.

Not certain from the listing — there is no mention of logging, telemetry, or verification of retrieved content. Gaps here could allow silent modification of documentation payloads to go unnoticed.

The tool provides authentication documentation but does not appear to enforce strict access controls or cryptographic verification (e.g., signed content) on the retrieved SDK snippets themselves.

Designed to be consumed by other agents building auth flows. A compromised or poisoned MCP server could propagate insecure authentication patterns or malicious code snippets to multiple downstream developer agents.