Keboola MCP Server — agentic threat model

Not certain from the listing — the MCP server is model-agnostic and acts as an interface; however, it is highly vulnerable to indirect prompt injection where malicious data stored in Keboola buckets could hijack the executing LLM's instructions.

Directly exposes Keboola storage, bucket browsing, and SQL transformation execution. This creates a significant data exfiltration surface and risks unauthorized data modification or deletion within the connected project scope.

Exposes powerful tools for component and job management. Insecure tool integration or lack of strict input validation on SQL execution tools could allow agents to run arbitrary, destructive, or resource-intensive queries.

Not certain from the listing — the infrastructure security depends on how the MCP server is hosted and whether network-level isolation or query execution sandboxing is enforced to prevent lateral movement to other Keboola services.

Not certain from the listing — requires robust logging of all executed SQL transformations, bucket access, and job management actions to detect anomalous agent behavior, which is not detailed in the public directory.

Relies heavily on the connected Keboola project's API tokens and permissions. If the API token is over-privileged, the agent inherits full administrative control over the data platform, violating the principle of least privilege.

As an MCP server, this agent is designed to be called by other host agents or orchestrators, introducing risks of cascading failures or unauthorized data access if upstream agents are compromised.