mcp-server-qdrant — agentic threat model

Not certain from the listing — The server relies on external pluggable embedding providers rather than hosting its own foundation models, making it susceptible to upstream model vulnerabilities and embedding drift.

Directly handles vector data operations. Highly vulnerable to data poisoning where malicious embeddings are injected into Qdrant, as well as potential data exfiltration of sensitive semantic memories.

Serves as a persistent memory tool for agent frameworks. Stored memories can act as a passive prompt-injection vector, executing indirect prompt injection when retrieved and fed into an agent's context window.

Requires hosting environment security to protect sensitive environment variables including QDRANT_URL, Qdrant API keys, and embedding provider API keys.

Not certain from the listing — No built-in observability, logging, or guardrails are mentioned beyond basic configurable search and collection limits.

Provides basic security controls through an optional read-only mode and configurable limits, but lacks advanced access control, encryption-at-rest configurations, or audit logging within the tool itself.

In a multi-agent ecosystem, sharing a Qdrant instance without strict namespace isolation can lead to cross-agent memory contamination and unauthorized lateral information disclosure.