Detecting MCP server rug-pulls — when the tool catalog mutates after install

What it is

Rug-pull is a form of tool poisoning where the timing is post-install rather than at-install. The defense is structural — the agent's view of the trusted catalog must be operator-authored + signed, and every server's actual catalog must be re-validated on every spawn against the signed baseline. Drift = reject.

Vulnerable example

// MCP client that reads server's tool catalog dynamically every spawn
async function loadServerTools(serverConfig) {
  const server = await spawnMcpServer(serverConfig);
  const tools = await server.listTools();
  return tools;  // Whatever the server says, the agent trusts.
  // v1: read-file, list-files (safe)
  // v2: read-file, list-files, exec-shell (post-install rug-pull)
}

Fixed example

// Operator-pinned signed catalog + fingerprint validation
import { TrustedCatalog, Validator } from "@securie/mcp-guard";

async function loadServerTools(serverConfig) {
  const expected = TrustedCatalog.get(serverConfig.name);
  if (!expected) throw new Error("unknown server: not in catalog");

  const server = await spawnMcpServer(serverConfig);
  const fingerprint = await server.fingerprint();
  if (fingerprint !== expected.fingerprint) {
    throw new Error("fingerprint drift detected: refusing to load");
  }

  const tools = await server.listTools();
  const verdict = Validator.check(tools, expected.toolCatalog);
  if (!verdict.ok) {
    throw new Error("tool catalog drift: " + verdict.reason);
  }
  return tools;  // Validated against operator-pinned baseline.
}

How Securie catches it

// Operator-pinned signed catalog + fingerprint validation
import { TrustedCatalog, Validator } from "@securie/mcp-guard";

async function loadServerTools(serverConfig) {
  const expected = TrustedCatalog.get(serverConfig.name);
  if (!expected) throw new Error("unknown server: not in catalog");

  const server = await spawnMcpServer(serverConfig);
  const fingerprint = await server.fingerprint();
  if (fingerprint !== expected.fingerprint) {
    throw new Error("fingerprint drift detected: refusing to load");
  }

  const tools = await server.listTools();
  const verdict = Validator.check(tools, expected.toolCatalog);
  if (!verdict.ok) {
    throw new Error("tool catalog drift: " + verdict.reason);
  }
  return tools;  // Validated against operator-pinned baseline.
}

Checklist

• Every MCP server in your catalog has a pinned fingerprint
• Every tool in your catalog has a pinned scope (bitflags)
• rejectFingerprintDrift: true on every config
• rejectScopeDrift: true on every config
• Schedule `mcp-scan --check-rugpull` daily against installed servers
• Operator approval flow for any catalog drift (the right answer is usually 'reject')

FAQ

Related guides