MySQL MCP (kevinwatt) — agentic threat model

Not certain from the listing — the agent relies on an external LLM via the Model Context Protocol (MCP). The primary threat is model reprogramming or prompt injection leading the foundation model to generate malicious SQL queries (e.g., DROP TABLE or data exfiltration payloads) instead of benign analytical queries.

The agent directly interacts with a MySQL database as its primary data store. Threats include unauthorized data exfiltration of sensitive database records, data poisoning via malicious SQL writes, and lack of data lineage tracking for executed queries.

The agent framework exposes powerful tools for schema introspection and raw SQL execution. The primary threat is insecure tool integration, where the framework fails to sanitize or validate model-generated SQL before executing it against the database.

The agent holds database connection credentials. Threats include credential theft from the hosting environment, lack of network isolation between the MCP server and the database, and privilege escalation if the database user has excessive administrative permissions.

Not certain from the listing — there is no mention of built-in query logging, guardrails, or anomaly detection to flag suspicious SQL execution patterns or massive data transfers.

The security surface relies heavily on external configuration. A lack of strict database-level access controls (e.g., not enforcing read-only users) and missing audit trails for model-initiated queries pose significant compliance and authorization risks.

As an MCP tool, this agent can be orchestrated by other agents. The threat is cascading failures or trust abuse, where a compromised upstream agent uses this tool to silently extract or corrupt database contents.