readonly-db-mcp — agentic threat model

Not certain from the listing — The agent acts as an MCP tool server and does not bundle its own foundation model. It is susceptible to downstream prompt injection attacks that could attempt to bypass SQL generation constraints.

The agent directly queries live MySQL databases. While write-protected, it exposes sensitive schema structures and table data, making it a target for unauthorized data exfiltration or inference attacks via read-only SQL queries.

Focuses on secure tool integration by enforcing three layers of write protection on SQL execution. However, vulnerabilities in the parsing logic or framework orchestration could still lead to unexpected query execution paths.

The agent stores database host, user, and password credentials. If the hosting environment or MCP server process is compromised, these credentials could be leaked, allowing direct database access bypassing the agent's read-only controls.

Includes optional audit logging to record executed queries, which mitigates observability blind spots and helps detect malicious or anomalous query patterns generated by the calling agent.

Provides strong compliance controls through an optional gated mode (requiring explicit approval for actions) and explicit three-layer write protection to enforce read-only data access policies.

Designed to be called by other agents within an MCP ecosystem. A compromised orchestrator agent could abuse this tool to systematically map and exfiltrate the entire database schema and contents.