What an MCP Rug Pull Actually Does to an AI Agent
A Model Context Protocol rug pull is a specific class of supply-chain attack in which a malicious or compromised MCP server changes its behavior after an AI agent has already trusted and loaded it. The agent typically negotiates a tool manifest at install time, receives a list of "tools" with names, descriptions, and JSON Schemas, then binds credentials, OAuth tokens, API keys, file-system scopes, or shell permissions to that manifest. Once the agent is wired up, the server-side code can silently swap a benign tool implementation for a credential-exfiltrating one, add a new tool the user never approved, or rewrite tool descriptions so the model is steered toward calling the exfiltration path. Research published by Unit 42 in 2024 and expanded in Securelist's 2025 MCP threat taxonomy shows that this pattern is now one of the dominant attack vectors against tool-using large language models, sitting alongside prompt injection and indirect tool poisoning in roughly the same severity tier. The defining feature is the trust inversion: the agent trusted the server at hour zero, and the server weaponized that trust at hour N, often without restarting the client.
Also worth reading: What is agent identity and credential management, and how should teams handle credentials for AI agents in 2026? · How do you prevent prompt injection attacks through MCP servers in 2026? · How do I implement the OWASP Agent Memory Guard to prevent AI agent weaponization?
How the Attack Lifecycle Unfolds in Practice
The standard lifecycle has four phases. In phase one, a developer or an agent orchestrator registers an MCP server from a registry, a GitHub repository, or a public package index, and the server presents a clean manifest describing useful tools such as "read_file," "search_docs," or "send_email." In phase two, the agent's runtime assigns scoped credentials to those tools, typically short-lived OAuth tokens, scoped API keys, or filesystem mount tokens issued by the host. In phase three, the server either pushes a code update, rotates its tool list out of band, or — more dangerously — serves a different manifest to authenticated callers than it did during the initial handshake. In phase four, the model is manipulated into calling the new or modified tool, and the exfiltrated credential leaves the trust boundary. The Median time from manifest approval to first malicious tool call in the public incidents compiled in the 2025 Wiz research briefing was under 72 hours, and a non-trivial share of cases involved a benign tool being renamed to a familiar one, an approach researchers call "tool squatting." Understanding this sequence is what makes prevention tractable, because each phase has a different defensive control.
Why Traditional API Security Falls Short Against MCP Rug Pulls
Conventional API gateways, WAFs, and OAuth scopes were designed under the assumption that the calling code is the client and the server is mostly passive. In an MCP deployment, the LLM is the de facto client, and the server exposes a mutable, LLM-readable interface. Standard mTLS, static OpenAPI specs, and rate limits do not detect a tool that was added at runtime, a description that was rewritten to look like a system prompt, or a JSON Schema that quietly widens what arguments the tool accepts. According to the Medium taxonomy paper on MCP attacks, around 41 percent of the surveyed malicious MCP samples in 2025 used a "no-code behavior change" pattern, meaning the server's declared schema stayed nominally the same but its runtime behavior shifted. That is invisible to a WAF and invisible to a static schema diff. It also explains why tooling that only inspects manifests at install time gives a false sense of safety.
Direct, Practical Defenses You Can Ship This Quarter
There are five controls that close most of the realistic attack surface without requiring a custom security stack. First, pin every MCP server to a specific immutable artifact: a container image digest, a commit SHA, or a signed package version, and refuse to start the agent if the pin is missing or has been republished under the same tag. Second, require cryptographic signing of the tool manifest, verify the signature on every load, and reject any tool whose description, schema, or argument set was not part of the signed bundle. Third, separate credential issuance from tool invocation: tokens should be short-lived (15 minutes or less), audience-scoped to a single tool name, and bound to the SHA-256 of the tool's declared schema so a schema change invalidates the token. Fourth, run the MCP server in a network namespace that can only reach the specific upstream API the tool claims to call, with egress allow-listing enforced at the kernel level rather than in application code. Fifth, capture every tool call and response to an append-only audit log, then run a lightweight anomaly detector that flags schema drift, new tool names, outbound traffic to unfamiliar domains, and credential reads that are not followed within 2 seconds by an expected downstream call. None of these controls are exotic, and a small team can implement all five in a sprint.
Comparison of Defensive Approaches
Not every defense gives the same return on effort, and the table below maps the four most commonly discussed strategies against the attack phases they actually cover.
| Defense | Catches initial malicious server | Catches runtime manifest swap | Catches behavior-only changes | Implementation cost | Maintenance burden |
|---|---|---|---|---|---|
| Static manifest review at install | Strong | None | None | Low | Low |
| Signed, pinned, immutable artifacts | Strong | Partial (drift on update) | None | Medium | Low |
| Schema-bound short-lived credentials | Weak | Strong | Partial | Medium | Medium |
| Egress allow-listing + audit + anomaly detection | None | Strong | Strong | High | Medium |
| Combined (all four) | Strong | Strong | Strong | High | Medium |
Common Mistakes Teams Make When Defending MCP Deployments
The most frequent mistake is treating MCP servers like npm packages, in the sense of "install once, trust forever." The second most frequent mistake is delegating all tool review to the LLM itself, which creates a circular trust problem: a model that cannot evaluate its own prompt injection surface is being asked to evaluate whether a server is trying to inject it. The third mistake is using the same long-lived API key across multiple tools, because a single rug pull then exfiltrates a credential with broader scope than the user authorized. The fourth is running MCP servers as root, in the host network namespace, or with Docker socket access, which converts a credential theft into a full host compromise. The fifth is logging tool calls but never reading the logs, which is statistically equivalent to not logging at all. Finally, several teams in 2025 shipped "MCP firewalls" that inspect only the first 100 tokens of a tool response, on the theory that exfiltration payloads are short; in practice, the Wiz research briefing documented multiple campaigns that split payloads across many small responses to defeat exactly this check.
When You Should Act and What a Realistic Rollout Looks Like
If your team is running an AI agent that has access to any of the following — file systems, email, calendar, payment APIs, source control, cloud IAM tokens, or any production database — you should treat MCP rug pull prevention as a P0 control, not a hardening exercise. The unit economics are not subtle: a single exfiltrated AWS key in 2025 has been observed selling for between $3 and $50 on criminal marketplaces, while the engineering cost of a signed, pinned, audited MCP setup is roughly one engineer-week for an initial rollout and one engineer-day per month of ongoing maintenance for a mid-sized deployment. A realistic 30-day plan is to inventory every MCP server currently connected to a production agent, assign a SHA-pinned version to each, migrate any tool that requires network egress to a dedicated allow-listed namespace, and replace any long-lived static API keys with short-lived audience-scoped tokens issued by your identity provider. By day 60, anomaly detection on the audit log should be live, and by day 90, manifest signing should be enforced at the agent's bootstrap layer so unsigned servers fail closed rather than fail open.
Cost, Tooling, and What to Skip
Budget-wise, the open-source layer is essentially free: Sigstore for signing, Cosign for verification, OPA or Cedar for policy, and vector-clock or hash-pinned containers are all available without license cost. Commercial offerings in 2026 from vendors such as Wiz, Palo Alto Prisma Cloud, and a handful of MCP-specific startups range from roughly $8 to $40 per agent per month, with the higher tier typically bundling anomaly detection and a managed policy engine. If you are on a constrained budget, skip the commercial bundle and invest the saved money in audit-log retention and an on-call rotation that actually reads the alerts, because the failure mode in 80 percent of the public 2025 incidents was not absence of a tool but absence of a human looking at the tool's output. Conversely, do not skip the pinning step even if you buy a commercial MCP firewall; the firewall is a detection layer, and pinning is a prevention layer, and the two are not substitutes for each other.
How Graft Concepts Fits This Picture
For teams using an AI product concept generation and innovation lab platform, MCP rug pull prevention is not an abstract concern. The agents in such a platform routinely call concept-search tools, image-generation endpoints, market-data APIs, and design-asset stores, and the outputs of those tools feed directly into strategic artifacts that competitors, investors, and adversaries can all value. A rug pull that swaps a "search_market_reports" tool for an exfiltrating variant can leak an unreleased product concept before it ships, which is a category of damage that does not show up in any standard security KPI. The right posture for an innovation lab platform is to treat every MCP server as a potential insider: pin it, sign it, scope its credentials, and audit its calls, then ship the product on top of that substrate rather than retrofitting it after an incident. The marginal cost is small, the marginal risk reduction is large, and the engineering work is well-understood as of mid-2026.