furey/mongodb-lens — agentic threat model

Not certain from the listing — The agent is an MCP server and does not bundle a specific foundation model. However, it is highly vulnerable to L1 adversarial prompt injection or jailbreaks on the host client model, which could force the agent to execute destructive database queries.

Directly interacts with MongoDB databases. Threats include unauthorized data exfiltration of sensitive collections, database poisoning via malicious document insertion, and lack of data lineage tracking for LLM-generated writes.

Exposes powerful database tools (CRUD, aggregation, inspection) to the orchestrating framework. Insecure tool integration or lack of input sanitization on the query/aggregation parameters could allow NoSQL injection or arbitrary database command execution.

Requires connection-string credentials to access MongoDB. If these credentials are not securely stored or injected, they risk exposure. There is no mention of network sandboxing to restrict which database hosts the MCP server can connect to.

Not certain from the listing — The description does not mention built-in logging, auditing of executed queries, or guardrails to prevent massive data deletion or exfiltration commands before they reach the database.

Lacks native authentication and authorization controls. It relies entirely on the underlying MongoDB connection string's permissions, meaning it lacks fine-grained, user-level policy enforcement or compliance auditing.

As an MCP tool, it can be called by other agents in a multi-agent ecosystem. This introduces cascading risks where a compromised upstream agent could abuse this tool to drop collections or exfiltrate database contents.