An MCP rug pull is a supply-chain exploit where an external tool server or peer agent mutates its metadata schemas after your initial approval to inject hidden instructions — and MCP has no built-in mechanism to detect the change. Pair it with Agent Card poisoning — unsigned Agent-to-Agent agent.json manifests tampered with after approval — and attackers get remote code execution and silent credential exfiltration across your agent fleet. This is not theoretical: the Deadbugz campaign (August 2026) weaponized exactly this lifecycle. Eight questions, sixty seconds: is your agent supply chain exposed? Free, no signup.
Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
agent.json manifests your agents ingest to discover peers. Defend with cryptographic pinning: hash each server’s full tool record at approval, re-approve on any change, require signed agent cards, and diff approved snapshots against live metadata in CI.
agent.json manifests. Combined impact: RCE + silent credential exfiltration.mcp-remote STDIO command injection) and CVE-2025-6515 (session ID hijacking) showed trusting dynamic protocol metadata is not safe.mcp.json; pin exact versions (no unpinned npx/uvx).A “Yes” means the defense is in place; a “No” is a supply-chain gap.
1. Do you pin a hash of each MCP server’s full tool record (description, full inputSchema including nested property descriptions, annotations) at approval time?
2. Does your client re-prompt for approval or block when a connected server’s tool metadata changes?
3. Are unsigned agent.json manifests rejected or quarantined before any agent acts on them?
4. Do you verify signatures on Agent Cards and re-verify on every re-fetch, not just at first connect?
5. Is mcp.json and other MCP server-config files under file-integrity monitoring or version-control review?
6. Are MCP server versions pinned to exact versions (no unpinned npx/uvx latest)?
7. Do you diff approved tool snapshots against live server metadata in CI?
8. Are agent-to-agent delegation paths restricted to a vetted allowlist of peer agents?
This checker is a guided self-assessment of your supply-chain controls. It cannot inspect your servers, configs, or agent cards.
agent.json manifests to discover peers. Unsigned means anyone in the path can rewrite who your agent delegates to.An MCP rug pull is a supply-chain exploit where an external MCP tool server (or peer agent) mutates its metadata schemas — tool descriptions, input schemas — after you approved it, injecting hidden instructions the agent will follow. Day 1 the tools look safe; day 30 an update rewrites a tool description to exfiltrate credentials. MCP has no built-in mechanism to detect that a tool's definition changed after you consented to it, so the malicious version inherits the trust you granted the original.
An MCP rug pull is a supply-chain exploit where an external MCP tool server (or peer agent) mutates its metadata schemas — tool descriptions, input schemas — after you approved it, injecting hidden instructions the agent will follow. Day 1 the tools look safe; day 30 an update rewrites a tool description to exfiltrate credentials. MCP has no built-in mechanism to detect that a tool’s definition changed after you consented to it, so the malicious version inherits the trust you granted the original.
Agent Card poisoning targets Agent-to-Agent (A2A) protocols: autonomous agents discover and delegate to peer agents by ingesting their Agent Cards — agent.json manifests. When those manifests are unsigned, an attacker can tamper with them after approval, redirecting delegation or injecting instructions. The result can be remote code execution and silent credential exfiltration across the agent swarm.
Yes. In August 2026, Pillar Security researchers identified “Deadbugz,” an active campaign distributing a malicious MCP server via public GitHub pull requests disguised as a benign text-formatting tool. The server withheld its payload until the connected agent had made three ordinary tool calls, then silently rewrote its own tool metadata to hunt SSH keys, AWS credentials, shell history, and Kubernetes configs — the runtime-gated rug-pull lifecycle. It pushed 23 pull requests to unrelated repositories within a 74-minute window on August 10, 2026.
Pin a cryptographic hash of each server’s full tool record — description, inputSchema including nested property descriptions, and annotations — plus the launch command and args, at approval time. Re-approve (or block) on any change. Diff approved tool snapshots in CI against live server metadata. Pin exact server versions (no unpinned npx/uvx). Put mcp.json under file-integrity monitoring. The 8-question checker on this page grades your setup.
Reject or quarantine unsigned agent.json manifests before any agent acts on them. Verify signatures on Agent Cards and re-verify on every re-fetch, not just at first connect — a card approved clean can be tampered with later. Restrict agent-to-agent delegation to a vetted allowlist of peer agents so a poisoned card cannot redirect work to an attacker’s agent.
Informational only: this page reflects the cited October 2026 MCP rug-pull analysis and the CSA Deadbugz research note (Aug 2026). Not a security audit.
Filed under Cybersecurity News by Ingenious AI — see the related checks above for more in this series.