Prowler MCP (Lighthouse) — agentic threat model

Not certain from the listing — Lighthouse relies on external LLMs via the Model Context Protocol (MCP). The primary threat is prompt injection or adversarial reprogramming that could force the model to execute unauthorized cloud checks or misinterpret compliance findings.

The agent processes highly sensitive cloud configuration metadata and compliance reports. Risks include data exfiltration of cloud architecture details, lack of data lineage, and potential poisoning of the compliance knowledge base used for mapping.

The MCP server exposes hundreds of cloud security check tools to the agent. Insecure tool integration or tool misuse could allow an attacker to trigger resource-intensive scans, probe unauthorized cloud APIs, or bypass intended query boundaries.

The agent runs under active cloud credentials (AWS/Azure/GCP). If the hosting environment or the MCP server itself is compromised, it could lead to credential theft, privilege escalation, or lateral movement within the target cloud environments.

Not certain from the listing — There is no explicit mention of guardrails, evaluation frameworks, or specialized logging for the Lighthouse assistant's actions, creating potential blind spots in detecting malicious or anomalous cloud queries.

The agent's core purpose is compliance mapping, but it relies heavily on the IAM permissions of the cloud credentials provided to it. Strict adherence to the principle of least privilege (read-only IAM roles) is critical to prevent write-level abuse.

As an MCP server, this agent is designed to plug into broader agentic ecosystems (like Lighthouse or other MCP clients). This introduces risks of cascading failures or unauthorized cross-agent trust exploitation if a calling agent is compromised.