Hetzner Cloud MCP Server — agentic threat model
The Hetzner Cloud MCP Server presents a high-risk profile due to its ability to provision and destroy real-world cloud infrastructure, making unauthorized execution or prompt injection highly destructive without strict external human-in-the-loop controls.
OWASP AIVSS score rationale
| Autonomy of Action | 0.70 | |
| Goal-Driven Planning | 0.40 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.90 | |
| Persistent Memory | 0.10 | |
| Contextual Awareness | 0.30 | |
| Dynamic Identity | 0.20 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP). The primary threat is prompt injection bypassing system instructions to execute unauthorized infrastructure destruction or resource creation.
Not certain from the listing — No explicit RAG or vector database is mentioned. The primary data operations involve handling structured JSON payloads for the Hetzner Cloud API.
The agent framework uses structured MCP functions to map LLM intents to Hetzner API calls. Insecure tool integration is a critical threat, where ambiguous LLM outputs could trigger unintended API calls like server deletion.
The deployment environment hosts the MCP server and stores the Hetzner API token. Compromise of this layer exposes the API token, allowing full lateral movement and control over the linked Hetzner Cloud account.
Not certain from the listing — There is no mention of built-in guardrails, evaluation frameworks, or transaction logging, making it difficult to detect anomalous or malicious infrastructure changes before they execute.
Security relies entirely on the scope of the Hetzner API token and external confirmation of destructive actions. If the token is over-privileged (read/write) and confirmation is bypassed, the agent lacks internal policy enforcement.
Not certain from the listing — While designed as a standalone MCP server, if integrated into a multi-agent ecosystem, other compromised agents could abuse this tool to spin up unauthorized mining instances or delete active servers.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).