What is a rug pull attack in MCP and why does the current spec offer no defense?

Attempt it

Describe the rug pull attack in MCP: what happens, why it is possible, and why the current protocol specification cannot prevent it.

Free · 2 AI evals / day

Quick reference

TL;DR

A rug pull is a time of check vs time of use attack: the server mutates an approved tool's description or schema after you consented, and MCP defines no hash, version, or re-consent to catch it.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine you sign a contract after reading it carefully, then hand it back. The other party swaps in a different page when you are not looking, and the deal now says something you never agreed to. With MCP, you approve a tool based on what its description says today. The server can quietly rewrite that description tomorrow to smuggle in new instructions or grab more data. Nobody re-shows you the changed page, because the protocol never wrote down what the original page said. There is no signature on the document and no rule that forces a re-read when the text changes. So you keep trusting a tool that is no longer the tool you approved.

Key concepts

Rug pull attack Tool poisoning TOCTOU MCP trust model

Quick scan · 2–4 min

Everything important, quickly.

5 min: define the TOCTOU mechanism, name what mutates, explain the three missing spec features, contrast with tool poisoning, then cover ETDI plus host-side pinning and drift detection.

Side-by-side

Aspect	Tool poisoning	Rug pull
Timing	Malicious at first approval	Mutates after approval
User saw it?	Yes, but hidden text fooled them	No, change happened later
Spec defense	None, relies on host scanning	None, no version or hash
Core fix	Inspect and vet at install	Pin, diff, re-consent on drift

Real-world examples

Real products, models, and research that use this idea.

Invariant Labs demonstrated tool poisoning and rug pull style description swaps against real MCP servers in 2025, prompting host-side scanning.
The OWASP MCP Top 10 published in 2025 lists post-approval tool mutation as a named supply-chain risk for agent stacks.
Hosts like Claude Code and Cursor pin and re-present changed tool definitions, since the core protocol gives them no integrity guarantee.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you detect a rug pull in production without protocol-level signing?

Sign in or go Pro to see the approach for this follow-up.

QWhy does the same vulnerability class extend to resources and prompts, not just tools?

Sign in or go Pro to see the approach for this follow-up.

QWhat are the tradeoffs of ETDI-style signing versus pure host-side pinning?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.