Starknet MCP — agentic threat model
Starknet MCP presents an extremely high-risk profile because it grants LLM agents direct capability to sign transactions and move funds on the blockchain. The primary security boundary relies entirely on how securely private keys are stored and whether robust human-in-the-loop confirmations are enforced externally.
OWASP AIVSS score rationale
| Autonomy of Action | 0.80 | |
| Goal-Driven Planning | 0.40 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.90 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.50 | |
| Dynamic Identity | 0.80 | |
| Multi-Agent Interactions | 0.30 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — the Starknet MCP is a connector/toolset rather than an LLM itself. However, if the orchestrating LLM is subject to prompt injection, it could be tricked into signing malicious transactions or transferring funds to attacker-controlled wallets.
The connector queries blockchain data across multiple networks. Threat of data poisoning exists if an attacker manipulates RPC nodes or oracle data, leading the agent to make decisions based on spoofed chain states.
High risk of tool misuse and insecure integration. Since the tools can move funds and sign transactions, any vulnerability in the orchestrating framework's tool-calling logic could allow unauthorized smart contract calls.
Critical risk regarding secrets management. Private keys handed to the MCP server represent a high-value credential surface. If the hosting infrastructure or server is compromised, attackers gain direct access to the private keys.
Not certain from the listing — there is no mention of built-in logging, transaction guardrails, or anomaly detection. Without external observability, unauthorized transactions or key exfiltration could go unnoticed.
Not certain from the listing — no explicit authentication, authorization, or policy enforcement mechanisms (like multi-sig or transaction limits) are described, leaving key management highly vulnerable.
In a multi-agent or marketplace setup, a compromised or rogue agent could call this MCP to drain wallets or execute malicious smart contracts, abusing the trust boundary of the shared MCP server.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).