Prisma MCP Server — agentic threat model
The Prisma MCP Server introduces high agentic risk by granting LLMs direct administrative access to provision databases, alter schemas, and query sensitive data. Its security heavily relies on the client-side implementation of strict human-in-the-loop controls and least-privilege credential scoping.
OWASP AIVSS score rationale
| Autonomy of Action | 0.60 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.10 | |
| Contextual Awareness | 0.30 | |
| Dynamic Identity | 0.50 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.40 | |
| Opacity & Reflexivity | 0.20 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The Prisma MCP server is model-agnostic and runs via the Prisma CLI; however, the driving LLM is vulnerable to prompt injection which could lead to unauthorized database schema changes or data exfiltration.
The server directly queries and manages database data and schemas. Threats include unauthorized data exfiltration, data poisoning via malicious queries, and schema corruption.
Integrates as an MCP tool. Vulnerable to tool misuse where an LLM client incorrectly invokes destructive migrations or drops tables due to ambiguous instructions or prompt injection.
Runs locally or in a container via the Prisma CLI. Risks include local privilege escalation, exposure of Prisma Platform credentials stored in the environment, and lack of sandboxing for CLI execution.
Not certain from the listing — There is no mention of built-in guardrails, query logging, or anomaly detection to block destructive database operations before they execute.
Relies on Prisma/Platform credentials for authentication. The main risk is over-privileged credentials allowing the agent to perform destructive actions (like deleting databases) without granular access controls.
Not certain from the listing — If integrated into a multi-agent workflow, a compromised secondary agent could exploit this MCP server to gain full database access.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).