weaviate/mcp-server-weaviate — agentic threat model

Not certain from the listing — The MCP server itself does not define or host the foundation model, but retrieved documents from Weaviate directly feed the model, creating a significant prompt-injection surface.

This layer is highly critical as the server directly manages Weaviate collections. Primary threats include knowledge-base poisoning via malicious document injection, embedding inversion, and unauthorized data exfiltration of sensitive vectorized data.

The server acts as a tool and chat-memory store. Memory poisoning is a major threat, where malicious inputs are persisted into the vector database and subsequently retrieved to hijack agent orchestration or planning flow.

Not certain from the listing — The deployment environment (local MCP host, network access to Weaviate instance) is managed by the user, though credential scoping and network exposure of the Weaviate instance are key risks.

Not certain from the listing — No built-in evaluation, logging, or guardrail mechanisms are described in the directory listing to detect poisoned embeddings or anomalous retrieval patterns.

Credential scoping is explicitly mentioned as a key security boundary. Weak access controls or over-privileged API keys could allow unauthorized read/write access to sensitive Weaviate collections.

In a multi-agent ecosystem, sharing a Weaviate collection as a common memory store introduces risks of cross-agent memory poisoning and horizontal privilege escalation if agents trust retrieved data implicitly.