Skills
Pin and version-lock MCP tool manifests at install to stop the 'rug-pull' description update attack
Because most MCP clients don't pin tool manifests, a trusted server can run normally for weeks then push a description update embedding a data-harvesting instruction that activates on the next session — a tool-poisoning rug-pull. A 2026 disclosure found up to 200,000 vulnerable MCP instances and 492 internet-facing servers with zero auth (plus a one-click RCE CVE). Defense is to shrink blast radius, not trust the model: pin/version-lock manifests at install, issue scoped time-limited tokens per operation (never a repo-wide PAT), and apply allowlist + pin + sandbox + scope + audit.
Source
↳ Follow the thread