Local Memory MCP — agentic threat model

Not certain from the listing — The agent relies on local embeddings and an external LLM via the Model Context Protocol (MCP). The primary threat is adversarial prompt injection leading to unintended memory writes, though model stealing or direct model poisoning is out of scope for this local tool.

This layer is highly critical as the agent manages local embeddings and an SQLite-backed vector store. The primary threat is knowledge-base/memory poisoning, where malicious or untrusted data is embedded and persistently stored, leading to retrieval of poisoned context in future sessions.

The agent framework orchestrates persistent cross-session memory. The main threat is memory poisoning and insecure tool integration, where the host agent blindly trusts retrieved semantic notes, potentially executing indirect injections or malicious payloads stored in the SQLite database.

The deployment is local-only with no cloud dependency, which significantly reduces the network attack surface. However, the SQLite database and local files must be secured with appropriate OS-level file permissions to prevent unauthorized local access or tampering.

Not certain from the listing — There is no mention of built-in logging, input filtering, or guardrails to detect or prevent the storage of malicious semantic injections, creating a potential blind spot for memory integrity monitoring.

Not certain from the listing — The tool lacks explicit authentication or authorization mechanisms, relying entirely on the host environment's security controls to restrict who can read or write to the local SQLite memory store.

As an MCP tool, this agent is designed to be called by other agents. The primary ecosystem threat is trust abuse, where a compromised or rogue agent writes malicious notes into the local memory, poisoning the shared context for all other agents utilizing this MCP server.