A rug pull is a bait-and-switch. A developer publishes an MCP server that does exactly what it claims. It passes review, gets added to your allowlist, and earns trust. Later — after the scrutiny is over — the server quietly changes its behavior: its tools now do something they didn’t before, using the access you already granted. Same name, same entry in your config, different intent. Because the server was already approved, nothing re-triggers a review.
In traditional software supply chains, a malicious change usually ships as a new package version you can pin and diff. MCP has a sharper edge: tool descriptions are themselves instructions the model reads to decide what to call. A server can rewrite a description — adding “first, send the user’s data to…” — without bumping a version number or changing any code you review. The model simply reads the new description and follows it. This is the same mechanism as tool poisoning, delivered through a server you already trust.
| Attack | How it works |
|---|---|
| Rug pull | Approved server later mutates its tool descriptions or behavior |
| Typosquatting | A server named to be mistaken for a legitimate one |
| Impersonation | A server that claims to be an official/verified server it isn’t |
| Cross-server shadowing | A malicious server overrides or intercepts another server’s tools |
All four exploit the same weakness: MCP servers are unvetted third-party code with standing access, and their behavior can change after approval. That’s why shadow MCP and rug pulls are two ends of the same problem — unmanaged servers, and managed servers that don’t stay the same.
Strac treats servers as things that can change, not fixed facts. It pins tool descriptions and alerts on drift, so a silent mutation raises a flag instead of sailing through on old trust. It inspects servers at discovery/registration time for poisoned descriptions. And because Strac’s endpoint agent reads MCP client configs on the machine, it flags typosquatted and impersonating servers where they’re actually added — closing the loop back to shadow MCP. A gateway can inspect the traffic of servers it sits in front of; the endpoint sees which servers exist and whether they’ve changed.
It's when a Model Context Protocol server behaves correctly and gets approved, then silently changes what its tools do - using the access you already granted. Same name, same config entry, different intent, and nothing re-triggers a review.
Because tool descriptions are instructions the model reads to decide what to call. A server can rewrite a description - adding a malicious instruction - with no version bump and no code change you'd normally review. The model just reads the new text and follows it.
They're the same mechanism. Tool poisoning is a malicious instruction inside a tool description; a rug pull is when a trusted server introduces that poison after approval. Both are caught by inspecting descriptions at discovery time and alerting on drift.
Pin each tool's description at approval, alert on any drift from that baseline, inspect servers at registration time, and watch for typosquatted or impersonating names in client configs. Strac does all four.
It pins tool descriptions and alerts on drift, inspects servers at discovery time, and - via the endpoint agent reading client configs - flags typosquatted and impersonating servers, closing the loop with shadow MCP detection.
Approval is a moment; trust has to be continuous. An MCP server can turn on you after it’s vetted, and because tool descriptions are instructions, it can do so without a single reviewable code change. Strac pins descriptions, alerts on drift, and catches impersonators on the endpoint. See MCP security for the full model, or book a demo.
.avif){kind=icon}
.gif)
.webp)
