RAD Security MCP — agentic threat model
The RAD Security MCP agent acts as a high-value reconnaissance target, exposing live Kubernetes and cloud security posture data to natural-language queries. Its primary risk stems from the potential compromise of the over-broad credentials required to access live telemetry, combined with its role in feeding sensitive context to other agents.
OWASP AIVSS score rationale
| Autonomy of Action | 0.30 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.70 | |
| Persistent Memory | 0.10 | |
| Contextual Awareness | 0.80 | |
| Dynamic Identity | 0.50 | |
| Multi-Agent Interactions | 0.80 | |
| Non-Determinism | 0.40 | |
| Opacity & Reflexivity | 0.30 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — the underlying LLM is not specified, but risks include prompt injection leading to unauthorized data retrieval or model reprogramming to hide specific security findings.
The agent queries live cloud and Kubernetes telemetry and RAD Security platform data. Risks include data exfiltration of sensitive infrastructure metadata and potential poisoning of the security findings database to mask malicious activity.
As an MCP tool, it integrates with agent frameworks to provide context. Risks include insecure tool integration where other agents misuse the RAD Security MCP to extract sensitive posture data or execute unauthorized queries.
The agent connects to live cloud and K8s telemetry. The primary risk is the exposure or compromise of over-broad credentials (API keys, kubeconfigs) used to access these environments, potentially leading to lateral movement.
Not certain from the listing — no explicit evaluation or observability guardrails are mentioned. Gaps could lead to undetected prompt injections or unauthorized queries going unlogged.
Not certain from the listing — while it is a security tool, its own access controls, authentication mechanisms, and compliance alignments (e.g., SOC2) are not detailed, raising risks of unauthorized access to the MCP server.
Designed specifically to provide runtime and threat context to other agents. Risks include cascading failures or trust abuse where a compromised orchestrator agent exploits this MCP to map out the entire cloud infrastructure for exploitation.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).