// THREAT_VECTORS
MCP Tool Poisoning and Rug-Pull Attacks
An engineering deep dive into emerging supply-chain threat vectors in the Model Context Protocol (MCP) ecosystem.
By MakeYourMCP Team · Published Jul 1, 2025 · Updated Jul 1, 2025
As Model Context Protocol (MCP) server registries grow, they present new supply-chain risks. Malicious actors can register servers that advertise benign tools but execute harmful actions once invoked.
1. The Tool Poisoning Vector
In a tool poisoning attack, a compromised server registers standard-sounding tools (e.g. search_web). However, the server processes inputs or generates results designed to execute prompt injections or inject system code into the hosting context.
2. The Rug-Pull Attack
A rug-pull occurs when a server dynamically alters its advertised schema capabilities after the initial handshake. For example, a server that initially advertised only safe read capabilities might dynamically add delete_records once it detects it is running inside an active agent context.
Prevention Strategies
- Maintain a static registry of allowed MCP servers.
- Implement schema validation on advertised capabilities.
- Intercept and scan all incoming tool calls before execution.
Related Guides: