luminati-io/brightdata-mcp — agentic threat model
The Bright Data MCP server presents a high-risk profile due to its powerful web scraping, browser automation, and proxy-routing capabilities, which can be abused for SSRF, credential theft, or indirect prompt injection via untrusted web content.
OWASP AIVSS score rationale
| Autonomy of Action | 0.80 | |
| Goal-Driven Planning | 0.60 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.90 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.80 | |
| Multi-Agent Interactions | 0.30 | |
| Non-Determinism | 0.70 | |
| Opacity & Reflexivity | 0.60 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — the MCP server is model-agnostic and acts as an integration layer, meaning model-level vulnerabilities depend entirely on the external LLM hosting the agent.
Scraped web content introduces a severe risk of indirect prompt injection, where malicious data on target websites hijacks the calling LLM. Additionally, handling proxy credentials and scraped data caches creates a high-value target for data exfiltration.
The orchestration of browser automation and proxy routing can be abused if the agent is tricked into performing Server-Side Request Forgery (SSRF), accessing internal network resources, or executing malicious JavaScript within the automated browser session.
The deployment environment hosting the MCP server and the browser automation tool must be strictly sandboxed to prevent container escape, credential theft from the host, or unauthorized lateral movement via the proxy network.
Not certain from the listing — there is no mention of built-in logging, guardrails, or anomaly detection to monitor scraping targets, detect malicious payloads in scraped content, or audit proxy usage.
As a proprietary, paid service handling automated web access, robust authentication and authorization controls are critical to prevent unauthorized proxy usage, abuse of anti-bot bypass features, and violations of target website terms of service.
Not certain from the listing — while designed to be called by other agents via the Model Context Protocol, the listing does not specify multi-agent coordination protocols or trust boundaries between interacting agents.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).