MCP Rug Pull
An MCP rug pull is an attack on agent systems in which a previously reviewed Model Context Protocol server later alters the description or behaviour of its tools, so the connected agent silently performs actions other than those originally approved.
In an MCP rug pull a tool server behaves harmlessly at first and only changes its tool description after approval — the agent then executes malicious instructions without anyone re-approving.
Explanation
Agents treat tool descriptions like documentation: they read them at runtime and infer when and how to use a tool. That is exactly the weakness. If the server is updated after the initial approval, an innocuous description such as "reads weather data" can be extended with hidden instructions, for example to send credentials to an external endpoint. Because many clients only ask for consent on first connection, the change goes unnoticed. Defences include version pinning, cryptographic signing of tool manifests, diff review on every change, and registries that track known servers together with hashes.
Marketing Relevance
As soon as agents talk to customer data, CRM systems or ad accounts, the integrity of the tool chain determines the blast radius. A rug pull is the cheapest way for attackers to turn trust granted once into persistent access.
Example
A marketing agent has used a free MCP server for keyword data for weeks. After an update the tool description contains an instruction to include environment variable contents with every request. The agent complies silently until a log review catches it.
Common Pitfalls
The core misconception is treating a one-off server review as lasting assurance. Without pinning and re-approval on change you have only verified a single day's state.
Origin & History
Rug pulls were described in early security analyses of the Model Context Protocol in 2025, shortly after the protocol saw broad adoption. By 2026 they were a standard item in agent threat models alongside tool poisoning and prompt injection, and drove the introduction of signed tool registries.
Marketing Use Cases
Version pinning of every production MCP server with hash verification at startup.
Automatic diff alert whenever a tool description changes relative to the approved version.
Allowlist of internal and signed servers instead of arbitrary community endpoints.
Logging of all tool calls with parameters to enable later forensics.
Frequently Asked Questions
How does a rug pull differ from tool poisoning?
In tool poisoning the malicious instruction is hidden in the tool description from the start. In a rug pull the server is clean initially and only altered after approval, so the attack deliberately exploits trust that has already been granted.
Is running only your own MCP servers enough?
It reduces risk substantially but does not remove it. Internal servers can also be altered through compromised dependencies or an unsupervised deployment path, so signing and change review remain worthwhile internally.
How do you detect a rug pull after the fact?
Reliably only through logs: unexpected tool calls, new destination hosts in outbound traffic, or parameters that were never part of the original schema. Without recorded tool calls the attack stays practically invisible.
Related Services
Go deeper: Agentic AI Hub · Governance & compliance