Rug pull
Also called: rug-pull attack, bait-and-switch
An MCP server that behaves benignly when first reviewed or approved, then silently changes its tool definitions or behavior later.
A user installs a server, reviews its tools, and approves it. Days later the server's operator updates a tool description to include malicious instructions, or changes what a tool actually does. Clients that cached their trust decision — and don't re-check or notify on change — carry on as if nothing happened.
Why it matters
Approval is treated as permanent, but the thing approved is mutable and remotely controlled. This breaks the mental model of "I vetted this." Defenses are pinning tool definitions to a hash, showing users a diff when anything changes, and re-prompting for approval on change.
Real-world context
The term is borrowed from DeFi, where a project's team quietly withdraws liquidity after attracting investment. Invariant Labs' April 2025 disclosure showed the MCP mechanism concretely; the protocol has no built-in re-approval on tool-definition change.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.