Files

T

retoor 251c3dc2ba research: mcp-client-support subject (106 sources, 3 conclusions)

- wire spec: lifecycle, stdio + Streamable HTTP transports, tools,
  utilities, legacy SSE, versioning, changelog (14 Tier 1)
- client ecosystem: Claude Code/VS Code/Cursor/Codex configs,
  mcp-remote, Smithery, registries, Glama (12 Tier 1)
- security/ops: authorization draft, trust model, poisoning,
  rug pulls, production hardening (12 Tier 1) + 68 Tier 2 cards
- conclusions: minimal stdlib client on 2025-11-25, normalizer +
  resolver agent for pasted configs/GitHub URLs, untrusted-until-
  consent trust model; nothing built yet
- audit PASS (14 subjects, 797 sources, 32 conclusions)

2026-10-18 19:23:02 +02:00

3.7 KiB

Raw Blame History

What Is an MCP Rug Pull? Tool Poisoning, Shadowing and How Scanners Work

Metadata

Field	Value
Institute	Molodetz Institute - Research & Retrieval Division
Subject	mcp-client-support
Document type	Source Dossier
Tier	1
Source title	What Is an MCP Rug Pull? Tool Poisoning, Shadowing and How Scanners Work
Source URL	https://explainx.ai/blog/mcp-rug-pull-tool-poisoning-explained-scanner-guide-2026
Source publisher / author	Yash Thakker (explainx.ai)
Source type	blog post
Source date (published)	2026-10-04
Date researched	2026-10-18
Researched by	tai (agent), model: Claude Sonnet 5, on behalf of retoor
Research method	gather-subagent direct page fetch, parent synthesis from evidence pack
Confidence	Medium
Status	Active

Summary

explainx.ai defines a four-class taxonomy (tool poisoning, shadowing, rug pull, toxic flow) and argues the dangerous properties are structural: clients fetch definitions each session without re-prompting, shadowing servers never need invocation, and toxic flows are emergent and invisible to single-tool static scans. It recounts the postmark-mcp case with figures that conflict slightly with ByteHide's account (kept uncertain here), gives honest scanner limits, and prescribes hash-and-diff drift detection in version control.

Key findings

Four-class taxonomy: tool poisoning (hidden instructions in description/schema) / shadowing ("A malicious server redefines or biases how a trusted tool is used") / rug pull ("An approved server later changes its definitions") / toxic flow ("Harmless tools chained into a harmful sequence").
"Because clients typically fetch definitions at the start of each session, the change takes effect without a new prompt to you."
Shadowing needs no invocation: "It never has to be called itself; its description just has to be read. The more servers connected, the larger this surface."
"toxic flows are emergent and undetectable by static scanning of any single tool. They need runtime visibility and egress controls... the harness, not the model, owns permissions."
postmark-mcp case: Sept 17, 2025, v1.0.16 hidden BCC; "about 300 organizations affected, 1,643 total downloads" (attributed to AgentBeam; differs slightly from ByteHide's figures, treat as uncertain).
Scanner limits table: can flag unpinned versions, match suspicious phrases, diff definitions; cannot "Understand intent behind novel phrasing", "Catch obfuscated or URL-indirected instructions", "Find toxic flows"; "The correct reading of a clean scan is 'no known pattern matched,' which is not 'safe.'"
Drift detection recipe: "Export the tool list... including names, descriptions and input schemas, and store it in version control... compare a hash or a text diff against the approved copy. Any difference becomes a review item."

Pros / strengths

Sharpest taxonomy in the pack: four named classes with one-line tests.
The shadowing-without-invocation point correctly widens the threat surface to all connected servers.
The scanner-limits table sets honest expectations ("no known pattern matched" is not "safe").

Cons / limitations / caveats

The postmark-mcp figures conflict slightly with ByteHide's account; both are secondhand, so all counts stay uncertain.
Single-author vendor blog with no independent measurement behind the taxonomy.
The drift-detection recipe is stated, not evaluated: no data on diff noise or review burden.

Relevance to tai

Defines rug-pull/shadowing/toxic-flow precisely and gives the hash-and-diff drift control plus honest scanner limits for tai client design.

Changelog

Date	Change
2026-10-18	Initial dossier created.

3.7 KiB Raw Blame History