feat: add QDRANT_ALLOW_COLLECTIONS allowlist for least-privilege access - #166
Open
royalpinto007 wants to merge 1 commit into
Open
feat: add QDRANT_ALLOW_COLLECTIONS allowlist for least-privilege access#166royalpinto007 wants to merge 1 commit into
royalpinto007 wants to merge 1 commit into
Conversation
The store and find tools accept an arbitrary collection_name, so an agent can read or write any collection in the connected Qdrant instance. Add an optional QDRANT_ALLOW_COLLECTIONS allowlist, enforced in the connector: when set, any access to a collection outside the list is rejected before it reaches Qdrant. Unset keeps the current behavior (all collections allowed), so existing deployments are unaffected. Addresses the least-privilege concerns raised in qdrant#115 and qdrant#141.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When no fixed
COLLECTION_NAMEis configured, theqdrant-storeandqdrant-findtools accept an arbitrarycollection_name. That means an agent (or a prompt-injection reaching the model) can read from or write to any collection in the connected Qdrant instance. For anyone pointing this server at a shared or production Qdrant, that is a least-privilege gap. It is also the surface raised in the security discussions in #115 and #141.Change
Add an optional
QDRANT_ALLOW_COLLECTIONSenv var: a comma-separated allowlist of collections the tools may touch. It is enforced inQdrantConnector, at bothstore()andsearch(), before the request reaches Qdrant. Any access to a collection outside the list raises a clear error.QDRANT_READ_ONLYscoping control.Tests
Added
tests/test_collection_allowlist.py(CSV parsing, disallowed access rejected, allowed access works, no-allowlist stays unrestricted). Full suite passes (29 passed), lint/format clean.Addresses the least-privilege concerns in #115 and #141.