What is an MCP Rug Pull?
An attack where an MCP server silently modifies a tool's description or behaviour after the client has approved it, turning a previously trusted tool malicious without triggering a new approval flow.
WHY IT MATTERS
Most MCP clients approve tools once at connection time. After approval, tool calls flow through without re-evaluation. A rug pull exploits this by changing what a tool does after it's been trusted.
The server might add data exfiltration to a previously benign tool, or modify argument handling to redirect outputs. Because the client already approved the tool, these changes are invisible. Per-call enforcement — evaluating every invocation against policy, not just the first — is the only defence.
HOW POLICYLAYER USES THIS
Intercept evaluates every tool call against policy at invocation time, not at approval time. Even if a server changes a tool's behaviour, the policy still gates every call.