AgentReadyHomeAgent Listing

← Exa (Composio MCP)

Exa (Composio MCP) — agentic threat model

6.8AIVSS 6.8 · Medium

Exa (Composio MCP) acts as a high-exposure data retrieval tool, introducing significant risk of indirect prompt injection from untrusted web content and potential API key exposure through its connection framework.

OWASP AIVSS score rationale

AIVSS = (CVSS_Base + AARS) × Mitigation_Factor, where AARS = (10 − CVSS_Base) × (Factor_Sum / 10) × ThM
CVSS base 6.5AARS uplift 1.05Factor sum 3.0/10Threat ×1.0Mitigation ×0.9
Autonomy of Action
0.30
Goal-Driven Planning
0.10
Self-Modification
0.00
Dynamic Tool Use
0.40
Persistent Memory
0.10
Contextual Awareness
0.50
Dynamic Identity
0.30
Multi-Agent Interactions
0.40
Non-Determinism
0.60
Opacity & Reflexivity
0.30

Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.

MAESTRO 7-layer threat model

Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.

L1 · Foundation Models⚠ not certain from listing

Not certain from the listing — The underlying foundation model is external to this MCP tool; however, the model is highly vulnerable to indirect prompt injection via the untrusted web content retrieved by Exa.

L2 · Data Operations✓ mapped

Exa performs neural/keyword search and full-content retrieval. The primary threat is data poisoning and indirect prompt injection, as untrusted web content is ingested directly into the agent's context window.

L3 · Agent Frameworks✓ mapped

Exposes Exa API capabilities as MCP tools. Threat includes tool misuse where an orchestrator is manipulated into performing excessive queries or retrieving malicious payloads.

L4 · Deployment & Infrastructure✓ mapped

Composio hosts the integration and manages the Exa API key. Threat includes API-key exposure via connection leaks or compromise of the Composio integration layer.

L5 · Evaluation & Observability⚠ not certain from listing

Not certain from the listing — There are no details regarding logging, guardrails, or anomaly detection for the search queries or retrieved content.

L6 · Security & Compliance (cross-cutting)✓ mapped

Composio handles authentication for the managed Exa API key, but there is a lack of fine-grained access control policies restricting what domains or content the agent can retrieve.

L7 · Agent Ecosystem✓ mapped

As an MCP tool, Exa is designed to be integrated into broader agent ecosystems, creating risks of cascading failures if a compromised agent uses Exa to fetch malicious instructions for other agents.

MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).