conan-io/conan-mcp — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP). The primary threat is prompt injection leading to unauthorized tool execution, such as forcing the agent to fetch malicious C/C++ dependencies or bypass license checks.

The agent interacts with Conan package registries and local project files. Key threats include dependency confusion attacks, local cache poisoning, and the exfiltration of proprietary C/C++ source code or build configurations during dependency resolution.

The MCP server exposes tools for project scaffolding, dependency management, and vulnerability scanning. Insecure tool integration could allow an attacker to manipulate command-line arguments passed to the Conan CLI, leading to arbitrary command execution on the host.

Not certain from the listing — The deployment environment of the MCP server is unspecified. If run locally or in an unsandboxed container, a compromise of the Conan agent could lead to host file system access, privilege escalation, and lateral network movement.

Not certain from the listing — There is no mention of built-in guardrails, logging, or observability for the MCP tool calls. A lack of audit trails for dependency changes or vulnerability scan overrides represents a significant blind spot.

The agent performs license checking and vulnerability scanning, which are critical for compliance. However, there are no apparent access control mechanisms or policy enforcement engines to prevent the agent from installing non-compliant packages.

As an MCP tool, this agent is designed to be orchestrated by other agents. A compromised orchestrator could abuse this agent to inject malicious dependencies into a software supply chain, cascading the compromise to downstream systems.