gdrive-mcp — agentic threat model

Not certain from the listing — The agent relies on an external, unspecified LLM via the MCP host. The primary L1 threat is indirect prompt injection, where malicious content stored in Google Drive files hijacks the host model's instructions during retrieval.

The agent performs read-only search operations on Google Drive. The main threat is data exfiltration or unauthorized exposure of sensitive personal/corporate files retrieved from the Drive index and passed into the LLM context.

Implements the Model Context Protocol (MCP) for tool calling. The toolset is strictly limited to read-only search, significantly reducing the risk of destructive tool misuse, though framework-level parsing vulnerabilities remain a vector.

Runs locally on the user's machine, eliminating cloud-hosting risks but exposing local environment variables and the local file system if the host application or MCP server is compromised.

Not certain from the listing — There is no mention of built-in logging, audit trails, or guardrails to monitor what queries are executed or what file contents are returned to the LLM.

Authentication relies on a local Google credential file. Security is enforced via OAuth scopes restricted to read/search, aligning with the principle of least privilege, though local credential storage must be secured by the host OS.

Operates as a single-purpose utility tool within an MCP host. The primary ecosystem threat is another compromised agent in a multi-agent host environment querying this tool to silently harvest Google Drive data.