# MCP Server Threat Model: fill-in-the-blanks template

> Companion to [Threat-Modelling Your First MCP Server: STRIDE for the Agent Era](https://asrf.blog/blog/threat-modelling-mcp-servers).
> Copy this file per server. An afternoon of honest answers beats a week of process.
> Interactive version: https://asrf.blog/mcp-threat-model

## 0. The system

| | |
|---|---|
| MCP server name / version | |
| Operated by (team / vendor) | |
| Agent(s) that will connect | |
| Upstream systems it reaches | |
| Credentials it holds (list every one) | |
| Reviewed by / date | |

## 1. Data-flow sketch

Draw (or describe) the path: **Agent → MCP server → upstream systems**, and mark every trust boundary the data crosses. Note where *untrusted content* (web pages, documents, tickets, emails) can enter the agent's context.

```
[agent] --calls--> [mcp server] --creds--> [upstream]
untrusted content enters at: ______________________
```

## 2. Tool inventory & blast radius

One row per tool the server exposes. Be literal about the worst case.

| Tool | Reads | Writes/Deletes | Sends/Spends | Worst realistic outcome |
|---|---|---|---|---|
| | | | | |
| | | | | |

## 3. The six letters

Tick each question only when you can defend the answer out loud.

### S: Spoofing
- [ ] Could a malicious server impersonate this one in the agent's tool list (name collision, typosquat)?
- [ ] Does the server authenticate *which* client/agent is calling, or serve anyone who connects?
- [ ] Are its upstream credentials a distinct identity (not shared with humans or other services)?

### T: Tampering
- [ ] Have we read every tool description as *prompt context*? Could one steer the agent?
- [ ] Are tool definitions pinned, with alerts on change?
- [ ] Is transport integrity (TLS) enforced end to end?

### R: Repudiation
- [ ] Is every tool call logged with name, arguments, result, and invoking user?
- [ ] Could we reconstruct *which request and context* led to a destructive action?
- [ ] Do those logs land in central telemetry (not just local stdout)?

### I: Information disclosure
- [ ] Does this server complete the lethal trifecta (private data + external reach + untrusted content)?
- [ ] If yes: which leg have we cut, and how?
- [ ] Is network egress from tool execution default-deny / allow-listed?

### D: Denial of service
- [ ] Are tool calls rate-limited and budget-capped (tokens, API spend, downstream quotas)?
- [ ] Do slow or hanging tools time out instead of stalling the agent?

### E: Elevation of privilege
- [ ] Does every tool scope match the actual use case (no write/delete where read suffices)?
- [ ] Can chained calls compose into an action no single tool was meant to allow?
- [ ] Is the agent's authority bound to the invoking user (never more than that user alone)?
- [ ] Which irreversible actions require a human approval gate? List them: ______________

## 4. Rank & fix

List findings by **impact × likelihood**. Trifecta-shaped findings go first.

| # | Finding | Impact | Likelihood | Fix / owner / due |
|---|---|---|---|---|
| 1 | | | | |
| 2 | | | | |

## 5. The one question that decides it

> **"If a malicious instruction reached this agent through the data it reads, what's the worst tool it could reach, and have I gated that?"**

Answer: ______________________________________________

**Verdict:** ☐ Connect  ☐ Connect with gates listed above  ☐ Do not connect yet