Threat-Model Your MCP Server

PROJECT CONTEXT:
My MCP server exposes tools to agents (and through them, to untrusted content), but I have never threat-modeled it. Guardrail projects that ship real threat models show MCP servers have specific attack surfaces worth mapping deliberately.

GOAL:
Produce and act on a threat model for my MCP server: asset inventory, entry-point and trust-boundary analysis, ranked threats, and implemented, tested mitigations.

REQUIREMENTS:
- An asset inventory: what the server can access, expose, or affect
- Entry points and trust boundaries mapped (who calls, with what authority, over what transport)
- Threats enumerated per boundary using a structured method (STRIDE or equivalent)
- Threats ranked by impact and likelihood, with mitigations assigned
- Mitigations implemented and verified by targeted tests

CONSTRAINTS:
- Assume callers may be driven by injected/untrusted content - the agent is not a trusted user
- Every high-rank threat needs a mitigation with a test proving it

DEFINITION OF DONE:
- The threat model documents assets, boundaries, and ranked threats
- High-rank threats each have an implemented mitigation
- Tests demonstrate each key mitigation blocking its threat
- Residual risks are documented and accepted explicitly

COMMON FAILURES TO AVOID:
- Shipping an MCP server with no analysis of what it exposes
- Trusting the calling agent implicitly despite injection risk upstream
- Threats listed but never mitigated or tested
- No record of accepted residual risk, so gaps are forgotten