mcp-server-qdrant

qdrant/mcp-server-qdrant

This project is the official MCP server and Kiro plugin for storing and searching semantic memories in a Qdrant vector database. Its main risks are exposing an unauthenticated network server when run in SSE/Docker mode and allowing the agent to access or create arbitrary Qdrant collections if a default collection name is not configured.

What it can reach

Network

Connects to the configured Qdrant server URL, downloads embedding models from Hugging Face on first run, and can listen on a network port when started with SSE or streamable-http transport.

Files

Reads and writes local Qdrant database files when QDRANT_LOCAL_PATH is set, and caches downloaded FastEmbed models on disk.

Secrets

Reads QDRANT_API_KEY from environment variables to authenticate with the Qdrant server.

Shell commands

Includes a setup skill that instructs the agent to run shell commands such as uvx, ps, and curl to configure the environment.

Findings

1. MediumNo authentication on SSE and HTTP network transports

   Dockerfile:21

   When the server is run using the SSE or streamable-http transport (which is the default in the Dockerfile and recommended in the README for remote clients and IDEs), it listens on a network port without any authentication. Anyone who can reach that port on the network can read or write entries in the connected Qdrant database.

   Fix: Use stdio transport when running locally, bind the server only to 127.0.0.1, or place the SSE/HTTP listener behind an authenticating reverse proxy.

2. LowUnrestricted access to all Qdrant collections when COLLECTION_NAME is omitted

   src/mcp_server_qdrant/mcp_server.py:179

   If the COLLECTION_NAME environment variable is not set, the server exposes collection_name as a parameter on both the find and store tools. A prompt injection attack could trick the agent into reading sensitive data from other collections on the same Qdrant instance or creating arbitrary new collections.

   Fix: Always set the COLLECTION_NAME environment variable to restrict the MCP server to a single designated collection, and enable QDRANT_READ_ONLY if write access is not needed.

3. LowSetup skill instructs running an unpinned remote shell script

   kiro-power/skills/setup/SKILL.md:38

   The setup skill instructs the agent (after asking for user approval) to install uv by piping a remote script from astral.sh directly into sh without version pinning or checksum verification.

   Fix: Install uv through a trusted system package manager or verify the downloaded installer checksum before executing it.