ClinicalTrials.gov MCP — agentic threat model

Not certain from the listing — The connector does not specify the underlying foundation model used for matching, but any LLM consuming this tool is vulnerable to indirect prompt injection via untrusted study text retrieved from the public registry.

Retrieves public data from the ClinicalTrials.gov v2 API. While the source is a trusted government registry, the retrieved study text must be treated as untrusted external content. Patient data used for matching represents highly sensitive health context that requires strict client-side isolation to prevent data exfiltration.

Exposed as an MCP tool. Vulnerabilities include insecure tool integration if the orchestrating agent framework fails to sanitize inputs/outputs or passes sensitive patient context to unencrypted logs or external APIs during the matching process.

Not certain from the listing — The deployment environment of the MCP server is unspecified. Security relies on the host environment's network security, secure transport (HTTPS) to the government API, and sandboxing of the runtime.

Not certain from the listing — No built-in observability, logging, or guardrails are mentioned. Monitoring is required to detect anomalous query volumes or attempts to exfiltrate patient data through matching queries.

The patient-to-trial matching capability touches sensitive health context, introducing significant compliance risks (e.g., HIPAA, GDPR). The listing mitigates this by recommending that patient data stay client-side, but enforcement depends entirely on the implementing system's policy engine.

As an open-source MCP tool, it is designed to be integrated into larger agentic workflows. Risks include cascading failures if the upstream government API is rate-limited, and trust abuse if a compromised orchestrator forwards patient data retrieved or processed by this tool to unauthorized third-party agents.