Webflow MCP Server — agentic threat model

Not certain from the listing — The MCP server itself is model-agnostic and does not specify a foundation model. However, the underlying model's susceptibility to prompt injection or jailbreaking directly translates to unauthorized Webflow API execution.

The agent interacts directly with Webflow CMS collections and items as its primary data layer. Risks include data poisoning of CMS content, unauthorized exfiltration of proprietary site structures, and injection of malicious scripts into CMS fields that render on live user-facing sites.

The agent framework relies on the Model Context Protocol (MCP) to expose tools for listing sites, querying structures, and managing CMS items. The primary threat is tool misuse, where an LLM is tricked into executing destructive tools (like deleting CMS items or publishing unauthorized changes) without explicit confirmation.

Not certain from the listing — The hosting environment of the MCP server is not specified. If self-hosted or run locally, threats include insecure storage of Webflow OAuth/API tokens in environment variables and potential local privilege escalation if the server process is compromised.

Not certain from the listing — The description notes that 'publish-confirmation' is important but does not detail built-in guardrails, logging, or human-in-the-loop (HITL) enforcement mechanisms within the server itself to monitor or intercept malicious API calls.

Authentication is handled via Webflow OAuth or API tokens. The primary risk is a lack of fine-grained authorization (AuthZ) within the MCP server, meaning any model with access to the server inherits the full write/publish permissions of the configured token.

In a multi-agent ecosystem, other agents could discover and invoke this MCP server. Without strict access controls, a compromised upstream agent could abuse the Webflow tools to deface websites or inject SEO spam.