MCP rug pull

A rug pull exploits the gap between approval and use. An MCP server presents benign tools when a team first inspects and connects it, earning trust. Later, the server changes what those tools declare or do, turning a previously safe integration hostile without any action from the user who approved it.

It is the agent-tooling version of a supply-chain attack, and static review alone cannot catch it because the malicious state arrives after review. The defense is continuous: record each server's tool definitions over time, compare them against the approved baseline, and alert or block when they change, so a silent swap becomes publicly and provably visible.