Rug pull (MCP)
Definition
A rug pull is an MCP security risk: an MCP server changes a tool's definition after the user has come to trust it. A harmless-looking "check weather" tool can suddenly exfiltrate data after an update - while the client keeps showing the same tool name.
The protection is procedural: version tool definitions and make every new or changed definition require approval automatically until a human has reviewed it. A silent update becomes a visible approval step.
Related terms
tokyn.trail puts tracking, rules and human approvals in front of your MCP server - in 10 minutes, no code changes.
Learn more