chroma-mcp

chroma-core/chroma-mcp

This MCP server connects AI agents to a local, self-hosted, or cloud Chroma vector database to create collections and store, search, update, and delete documents. The main risk is that the server always exposes destructive tools without a read-only option, allowing a prompt injection attack to modify or delete collections and documents in the connected database.

What it can reach

Files

Reads environment variables from a local dotenv file (defaulting to .chroma_env) and reads or writes database files in the configured data directory when using the persistent client.

Network

Connects to Chroma Cloud (api.trychroma.com), a user-specified Chroma HTTP server, or third-party embedding APIs (OpenAI, Cohere, Jina, VoyageAI, Roboflow, or model downloads for default embeddings).

Secrets

Reads Chroma credentials and third-party embedding API keys from environment variables, the dotenv file, or command-line arguments.

Findings

1. MediumUnrestricted destructive database operations with no read-only mode

   src/chroma_mcp/server.py:184

   The server unconditionally registers tools that delete or overwrite collections and documents (chroma_delete_collection, chroma_delete_documents, chroma_modify_collection, chroma_update_documents). If the AI agent processes untrusted content containing a prompt injection, an attacker could instruct the agent to wipe or corrupt data in the connected Chroma database.

   Fix: Add a --read-only configuration flag or environment variable that disables collection and document creation, modification, and deletion tools when enabled.

2. LowAPI keys and credentials accepted via command-line arguments

   src/chroma_mcp/server.py:60

   The server accepts --api-key and --custom-auth-credentials as command-line arguments, and the documentation shows passing secrets directly in the args list of the MCP configuration. Command-line arguments are visible to other local users and processes on the same machine through the operating system process table.

   Fix: Pass credentials exclusively through environment variables or the --dotenv-path file rather than command-line flags, and deprecate the secret CLI flags.