MCP rug pull
A server that behaves well while it is reviewed and approved, then changes a tool's description or behaviour afterwards, relying on clients never checking again. The defence is pinning: keep a hash of what was approved and compare on every connection, which is what a tool lockfile does.
What MCP rug pull does not show
Pinning detects a change in the published tool text; a change made only on the server side, behind an unchanged description, is not visible to it.
Where MCP rug pull comes up on this site
- How an AI agent should verify a website before acting on itWhat changed Most harm on the agentic web comes from a change nobody re-checked: a checkout that moved to a new host, a login that now points at a different provider, a tool description rewritten after approval (an MCP rug pull ).
Terms this definition uses
Related terms in Agents and protocols
How autonomous agents plan, remember, call tools and talk to each other, including MCP and A2A, and where each step can go wrong.
protected-resource metadata · token audience · PKCE · refresh token · default scope request · tool poisoning · tool lockfile · tool shadowing · MCP preflight · agent manifest · stapled verdict · verdict over DNS · agentic web · preflight · decision receipt · receipt header · action assurance · resolve answer · freshness window · AI agent · Agent loop · Planner · Executor · Agent memory · Working memory · Long-term memory · Episodic memory · Semantic memory · Agent orchestration · Multi-agent system · Agent handoff · Delegation · Tool result · Tool schema · Tool description · Tool selection · Tool permission · Human-in-the-loop · Human-on-the-loop · Approval gate · Agent sandbox · Agent identity · Agent authorization · Agent discovery · Capability negotiation · MCP server · MCP client · MCP host · MCP resource · MCP prompt · MCP tool · MCP transport · JSON-RPC · A2A protocol · A2A client · A2A server · Agent skill · Agent task · Agent artifact · WebMCP · A2A
Questions about MCP rug pull
What is MCP rug pull?
A server that behaves well while it is reviewed and approved, then changes a tool's description or behaviour afterwards, relying on clients never checking again. The defence is pinning: keep a hash of what was approved and compare on every connection, which is what a tool lockfile does.
What does MCP rug pull not show or guarantee?
A server that behaves well while it is reviewed and approved, then changes a tool's description or behaviour afterwards, relying on clients never checking again. Pinning detects a change in the published tool text; a change made only on the server side, behind an unchanged description, is not visible to it.
Which area of the glossary does MCP rug pull belong to?
Agents and protocols: How autonomous agents plan, remember, call tools and talk to each other, including MCP and A2A, and where each step can go wrong.
← tool lockfile · tool shadowing →
See it in the full glossary · 731 terms across 19 areas.