selfhosted-doctor — agentic threat model

Not certain from the listing — the underlying LLM is not specified, but adversarial prompt injection could cause the model to ignore critical security risks or leak parsed .env secrets in its output.

The agent directly ingests highly sensitive local data, including .env files with plaintext secrets and Cloudflare Tunnel configurations, creating a high risk of data exfiltration if the context is leaked.

As an MCP server, insecure tool integration or prompt injection could exploit the file-reading tools to access unauthorized local files beyond the intended workspace.

Runs locally (often in Docker/homelab). If the host environment is not properly sandboxed, a compromised MCP server could serve as a vector for local reconnaissance, though its operations are described as read-only.

Not certain from the listing — there is no mention of built-in logging, guardrails, or evaluation frameworks to detect if secrets are being exfiltrated or if the scan results are being manipulated.

Lacks built-in authentication or authorization controls; it relies entirely on the host MCP client's permissions. Handling plaintext secrets in memory violates standard credential-handling compliance policies.

Not certain from the listing — if integrated into a multi-agent system, other untrusted agents could query this agent to indirectly extract sensitive homelab configuration details and secrets.