Re-scan MCP tool descriptions on every server update and reject silent changes.

Command injection is 43% of MCP CVEs in early 2026, with pipes, semicolons, and ampersands in AI-generated arguments going straight to the shell. Beyond sanitizing args, treat tool metadata as a security surface: scan descriptions at install and at every update, because a trusted server can be quietly updated to alter a tool's behavior after your agent learned to call it. That's the rug-pull, and change-detection is the defense (source).