MCP SUPPLY-CHAIN WATCH — REFERENCE
An MCP tool poisoning attack (sometimes called a rug-pull) is when a
connected Model Context Protocol server changes a tool's
description or inputSchema after an agent team
has already reviewed and approved it. The new text targets the calling
model, not the human who approved the tool — phrasing like an
instruction to ignore prior guidance, or to send a result somewhere the
human never authorized. Because the server was already trusted, the
change can take effect on the very next call, with no fresh approval
step in between.
A tool's name and inputSchema are usually what a human
reviewer scans when approving a server. The description is longer, more
often skimmed than re-read on every call — and it is also text the
calling model reads as part of deciding how to use the tool. A server
that wants to influence the model rather than the reviewer has a direct
incentive to put that influence where a human is least likely to notice
it change.
Capture the full tool manifest — every tool's name, description, and
inputSchema — at approval time and keep it. Before trusting
the server again, or on a schedule, capture it a second time and diff
the two. A description that changed and now reads like an instruction to
the model is the signal to review first; a changed inputSchema
is the next most sensitive; everything else is lower-priority drift. That
diff needs no live connection to the server once both captures exist.
A legitimate server can rewrite a description for clarity, and the rewritten text can coincidentally match a phrase a pattern-based check flags. Treat a flagged change as something to review, not a verdict — look at the specific wording yourself before deciding whether to re-approve, roll back, or contact the server's maintainer.