Perplexity Ask MCP Server — agentic threat model

Utilizes Perplexity's Sonar models for live web-grounded Q&A. The primary threat is model reprogramming or alignment bypass via adversarial web content retrieved during real-time searches.

Performs real-time RAG by fetching external web content. Highly vulnerable to data poisoning and indirect prompt injection, as untrusted third-party web pages are ingested directly into the context window.

Exposes a tool-calling interface via the Model Context Protocol (MCP). Vulnerabilities include insecure tool integration if the host client executes actions based on the injected instructions returned in the search results.

Requires local or containerized deployment as an MCP server, authenticating via a Perplexity API key. Risks include local credential exposure of the API key if the host environment is compromised.

Not certain from the listing — likely relies on the host MCP client for logging and monitoring of tool execution, with no explicit mention of built-in guardrails or injection-filtering layers.

Implements basic API-key authentication to access the Perplexity Sonar API. Lacks advanced authorization policies, relying on the user to secure the local MCP configuration.

Designed to operate within an MCP ecosystem where other agents or clients call this server. A compromise or injection in this server can cascade to other connected agents in the client workspace.