Teradata MCP Server — agentic threat model

Not certain from the listing — The underlying foundation model is not specified, but it is vulnerable to prompt injection attacks that could be translated into malicious SQL queries or administrative commands.

Directly interfaces with Teradata databases for querying, analysis, and AI/ML pipelines. The primary threat is unauthorized data exfiltration, data poisoning, or destructive schema modifications via SQL injection or prompt-driven manipulation.

The agent framework exposes database administration and querying tools. Insecure tool integration is a critical threat, as a single DATABASE_URI credential allows the agent to execute highly privileged administrative operations without sufficient isolation.

The deployment relies on a single DATABASE_URI containing privileged credentials. Compromise of the hosting environment or container would expose these credentials, leading to full database compromise and potential lateral movement.

Not certain from the listing — There is no explicit mention of query logging, guardrails, or anomaly detection to monitor and intercept malicious administrative commands generated by the agent.

The listing claims 'enterprise security controls' are integrated, but the reliance on a single privileged connection string suggests a lack of granular, user-level authorization and auditability for agent-initiated actions.

As an MCP (Model Context Protocol) server, this agent is designed to link other AI agents to Teradata. This creates a significant risk of cascading failures and trust abuse if upstream agents pass untrusted inputs that trigger administrative tools.