Root Signals MCP — agentic threat model

Not certain from the listing — The underlying foundation models used to run the evaluation criteria and scoring are not specified, leaving them potentially vulnerable to adversarial prompt injection designed to bypass evaluation guardrails.

Processes the agent's own content and reference data used for scoring. This introduces risks of data exposure or poisoning of the reference datasets used to evaluate and gate outputs.

Integrates via the Model Context Protocol (MCP) to enable self-improvement loops. Vulnerabilities in the orchestration framework could allow an attacker to manipulate the scoring criteria or bypass the evaluation loop entirely.

Not certain from the listing — The hosting environment, sandboxing of the evaluation server, and transport security for MCP tool calls are not detailed in the public directory listing.

Directly addresses this layer by providing evaluation, criteria-based scoring, and guardrails. The primary threat is evaluation gaming, where adversarial agent outputs are crafted to trick the scorer into rating them as safe.

Not certain from the listing — There is no explicit mention of access control, authentication mechanisms for the MCP server, or compliance certifications in the provided description.

Designed to interact with other agents to evaluate their outputs. This creates a multi-agent trust boundary where a compromised agent could feed malicious payloads to the Root Signals MCP server to exploit the evaluation parser.