databricks-mcp — agentic threat model

Not certain from the listing — the agent relies on external LLMs via the Model Context Protocol (MCP) to generate SQL queries, making it susceptible to prompt injection that could craft malicious read-only queries to bypass intended schema boundaries.

Directly interfaces with Databricks SQL warehouses. While mutation risk is mitigated by read-only access, the primary threat is unauthorized data exploration, profiling, and exfiltration of sensitive database records via injected SQL commands.

Exposes tool definitions for SQL querying and data profiling. Vulnerabilities include insecure tool integration if the hosting MCP client fails to sanitize inputs before passing them to the Databricks SQL execution tool.

Requires hosting with access to a DATABRICKS_TOKEN and HTTP path. Compromise of the hosting environment or MCP server process would expose these high-value secrets, granting direct warehouse access to attackers.

Features a configurable MAX_ROWS cap as a runtime guardrail to limit exfiltration volume. However, there is no mention of query-level anomaly detection, rate limiting, or audit logging of executed SQL statements.

Enforces token-based warehouse authentication and read-only access controls. However, it lacks fine-grained user-level authorization mapping, meaning any user interacting with the agent inherits the permissions of the underlying DATABRICKS_TOKEN.

Designed as an MCP tool to be called by other orchestrators or agents. This introduces cascading risks where a compromised upstream agent could abuse this tool to systematically harvest data from the Databricks warehouse.