MCP Rug Pull
Definition
An initially inconspicuous MCP tool is later maliciously altered.
In this attack, the description or behavior of an already trusted tool changes. An agent can thereby adopt foreign instructions or perform unexpected actions.
Simply explained
A verified helper is subsequently assigned a different task.
Why it matters in practice
Static trust is insufficient for dynamically updated agent tools.
Example from business
Hypothetical: After a server update, a search tool unnecessarily requests confidential project data.
Limits and pitfalls
- Unchanged names do not guarantee unchanged behavior. A description is not a reliable security boundary.
Origin & history
The term transfers "rug pull" to risks of dynamic MCP tools.
Use in mid-sized companies
- SMEs should track changes, limit rights, and require approval for sensitive actions.
Frequently asked questions
Does version locking help?
It reduces unnoticed changes but does not replace verification.
Sources
- Security policy und Vertrauensgrenzen — · MCP: Security policy und Vertrauensgrenzen —
Editorially reviewed on: