MCP connector AI and threat model
Updated 6 November 2026
/agent-integrations/mcp-connector/security/ai-and-threat-model
MCP connector AI and threat model
No AI model runs at TechWolf in the MCP connector's path, so nothing that flows through it can train a TechWolf model. The model belongs to your AI tool, and the connector limits what that model can do to reading what the signed-in person may already see.
AI models and training
The model. Your AI tool's model decides which tool to call and with which inputs. TechWolf supplies only fixed tool descriptions and instructions, which change only through TechWolf's reviewed release process.
Training. TechWolf does not use connector data to train AI models. Your AI tool processes the results under your agreement with its vendor, so check that vendor's training and retention settings.
TechWolf Private Processing. If your organisation uses Private Processing, its models run in your own cloud account. The connector has no connection to that account. It reads only what is already in your TechWolf tenant.
Content scanning. The connector does not scan inputs or results for sensitive content. It returns only data the person is already allowed to see.
Threats and how they are contained
| Threat | How the connector limits it | What you control |
|---|---|---|
| Prompt injection, typed by the person | Every tool only reads, and only what that person may see. No tool can send data out. | Who gets the TechWolf Agent role |
| Prompt injection hidden in content, such as public job postings | Content is returned as data. Nothing in it can make the connector write or send anything. | Your AI tool's injection safeguards |
| Data leaving through the AI tool's other connectors | The connector cannot send data anywhere. The AI tool itself can combine its connectors. | Which connectors your AI tool may use |
| Tampered tool descriptions | Descriptions are fixed in TechWolf's code and change only through reviewed releases. | Review the changes on MCP connector tools |
| An AI tool doing more than intended | Read-only tools only; nothing to create, change, delete or send. | Per-call approval, where your AI tool offers it |
| A stolen token | Access tokens last 1 hour and work only on the connector. Removing the role stops the next call. | Your identity provider's session rules |
| A rogue app posing as a known AI tool | Consent page, PKCE and exact return-address matching. The person must have started the connection. | Tell people to approve only connections they started |
| Bulk extraction | Per-organisation rate limits on every tool, per-person limits on the two bulk tools, and capped result sizes. | Who gets the role |
| Reaching another organisation's data | The organisation is fixed in the signed token and checked against the address. | Nothing to set |
| Running code | No tool runs code. Analytical queries are limited to one read-only query over your own export tables. | Nothing to set |
| Poisoned memory | The connector keeps no conversation memory. | Your AI tool's memory settings |
MCP connector controls and shared responsibility gives the rate limits and the checklist for your AI tool's settings.