pd-tools-mcp (ProjectDiscovery tools) — agentic threat model

Not certain from the listing — The underlying foundation model is not specified, but it is highly vulnerable to prompt injection or jailbreaks that could force the agent to target unauthorized IP ranges or domains.

Not certain from the listing — The agent primarily processes dynamic network reconnaissance data rather than relying on a persistent vector database or RAG pipeline, though target lists and scan results represent sensitive operational data.

The MCP framework integrates highly sensitive command-line tools (subfinder, dnsx, naabu, httpx, nuclei). The primary threat is insecure tool integration and tool misuse, where an LLM dynamically constructs arguments or targets, leading to remote code execution or unauthorized scanning.

Not certain from the listing — The deployment environment requires robust sandboxing and network egress controls to prevent the agent from scanning internal RFC1918 space or being used as a proxy for SSRF/lateral movement.

Not certain from the listing — There are no mentioned guardrails, logging, or evaluation mechanisms to monitor, rate-limit, or audit the active scans initiated by the LLM.

Not certain from the listing — The toolchain lacks built-in identity, authorization, or scope-limiting policies (e.g., blacklisting government or internal IPs), raising severe compliance and legal liability concerns.

As an MCP server, this agent is designed to be called by other agents or host clients. A compromised orchestrator agent could abuse this toolchain to conduct automated, distributed attacks without human oversight.