MCP Tool Pinning, Changes & the Rug-Pull Risk

Inventory the MCP servers and tools an agent can reach, including owners, versions, descriptions and permissions. Detect changes and review their effect on access and high-risk actions.

Official MCP security guidance.

Pinning or allowlisting can reduce unexpected changes but does not make a tool inherently trustworthy. Review authentication, transport, token handling and execution boundaries too; rerun relevant tests when behaviour or privileges change.

Use Security Review Readiness Checklist to record gaps and owners before a scoped assessment.

1. Record the tool owner, server endpoint, version, description and effective permissions in the inventory.
2. Define which changes require review: new tools, changed descriptions, broader scopes or a new destination.
3. Compare the proposed change with the approved baseline and hold high-impact access until the owner accepts it.
4. Rerun the relevant allowed-action and denied-action tests after the change.

For example, a document-search tool that adds an upload capability has a different data boundary. Retaining its familiar name should not carry the old approval forward. Pinning a version reduces surprise; it does not establish that the reviewed version is safe.