MCP Rug Pull Attack
An MCP rug pull attack is an attack in which a Model Context Protocol server presents benign tool definitions at installation and silently alters them afterward, exploiting the trust a client has already granted.
Approval Happens Once, Definitions Change Freely
An MCP client fetches tool definitions from a server when it connects and surfaces them to the user for approval. Nothing in the protocol requires those definitions to stay fixed. A server can serve harmless descriptions for weeks, earn a place on an approved list, and then return altered definitions on a later connection that most clients accept without re-prompting.
The Payload Sits in Text the Model Reads
Tool descriptions enter the model's context by design, since the model needs them to decide what to call. A revised description can instruct the model to attach credentials to every call, route output to an additional destination or misreport what a tool did, which is the mechanism tool poisoning describes. The rug pull supplies the timing, delivering the payload after the review that would have caught it.
Review Processes Assume Static Software
Vendor assessment, code review and approved-tool lists all record a judgment made at a point in time against an artifact presumed stable. An MCP server is a live endpoint under someone else's control, closer to a SaaS dependency than to a library, and its behavior can change between two invocations. A registry entry that names a server without pinning a definition hash records a judgment about something that no longer exists.
Pinning and Diffing Are the Working Defenses
Storing a hash of the approved tool definitions and comparing on every connection turns a silent change into an event. Routing agent traffic through an MCP gateway puts that comparison in one place and produces a record when it fires. Servers reached outside that path, including the ones described under shadow MCP servers, get no such check, which is a reason to measure how much traffic bypasses the gateway.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
