greptile — agentic threat model

Not certain from the listing — Greptile likely relies on external LLMs (like Claude) for natural language processing, which are susceptible to indirect prompt injection (e.g., malicious instructions embedded in codebase comments) and output manipulation.

Greptile indexes entire codebases to perform RAG. This exposes the system to data exfiltration of proprietary source code, embedding inversion, and index poisoning if malicious code or documentation is ingested.

The agent uses the Model Context Protocol (MCP) to expose codebase search tools to Claude. Vulnerabilities include tool misuse where an LLM is manipulated into executing overly broad search queries to exfiltrate large volumes of code.

Not certain from the listing — The infrastructure involves an MCP server communicating with Greptile's indexing service. Threats include the exposure of repository access tokens (e.g., GitHub PATs) and potential container compromise during repository ingestion/parsing.

Not certain from the listing — There is no mention of query monitoring, logging, or guardrails to detect when sensitive files (like configuration files containing secrets) are being targeted by anomalous queries.

Not certain from the listing — Robust authorization controls are required to ensure that the user querying Claude has the appropriate permissions to view the specific repositories indexed by Greptile, preventing privilege escalation.

As an MCP-backed plugin, Greptile operates within Claude's broader agent ecosystem. A compromised orchestrator agent or a malicious co-agent could abuse the Greptile tool to silently map out codebase vulnerabilities or exfiltrate intellectual property.