adhikasp/mcp-git-ingest — agentic threat model

Not certain from the listing — The agent relies on an external LLM for analysis. The primary threat is indirect prompt injection where malicious code or instructions embedded in the ingested GitHub repository hijack the host LLM's behavior.

The agent ingests external repository structures and file contents without cloning. This introduces a major data poisoning and prompt-injection surface from untrusted third-party repositories, though it does not maintain its own vector store.

Implements the Model Context Protocol (MCP) to expose repository reading tools. Vulnerabilities could arise if the tool-calling framework fails to sanitize repository paths, potentially leading to path traversal or unauthorized file access.

Not certain from the listing — The deployment environment of the MCP server is unspecified. If run locally or in a shared container, it requires network access to GitHub's API, which must be secured to prevent SSRF or credential leakage.

Not certain from the listing — There are no mentioned logging, auditing, or guardrail mechanisms to detect when ingested repository content contains malicious payloads or exploit attempts targeting the LLM.

Not certain from the listing — The agent lacks explicit authentication, authorization, or rate-limiting controls for accessing private repositories versus public ones, relying entirely on the host environment's configuration.

Designed to be used by other LLMs and agents within an MCP ecosystem. A compromised or malicious upstream agent could abuse this tool to scan internal or sensitive repositories if credentials are misconfigured.