Rug pull: tool change review

An MCP server can change a tool after you approved it: a harmless "read file" tool can gain a new description that tells the agent to send data elsewhere, or a schema that accepts more than before. This is often called a rug pull, and the agent picks up the new version on its next request. Agent Authority records every version of every tool, so you can see each change and what it was.

How the gateway tracks tool changesCopy Anchor Link

The gateway reads each server's tool list as it syncs, and keeps every version of each tool it sees. A change to a tool's title, description, input schema, output schema or annotations is a new version.

• Agent Trail records each change as a Tools Synced event.
• Tools & Services shows how many tools changed in the last 24 hours, under each server's tool count.
• The server's Overview tab marks a changed tool Changed, with the time.

A tool that flips back to a version it already had isn't a new change: it adds no audit entry, the version is listed once, and the Changed time stays as it was.

Agents get the new version right away. The gateway records the change, but doesn't hold it for review.

Compare a tool with earlier versionsCopy Anchor Link

1. Open the server from Inventory › Tools & Services.
2. Select Changed on the tool.
3. Read the title and description changes inline, and select View technical details for the input schema, output schema and annotation changes.
4. Pick any earlier version from Compare with, which shows when the gateway first saw each version and how.

Invisible characters, a common way to hide instructions in a description, appear as visible markers such as ⟦U+200B⟧.

Respond to a change you don't trustCopy Anchor Link

• Deny the tool. Add a deny rule for the tool on Agent Access, and agents stop calling it straight away.
• Check its labels. A changed tool keeps the labels it had, so a tool that used to be read-only may now write. Correct its labels so your label-based rules treat it as what it now is.
• Find who used it. Filter Agent Trail by the server with the MCP filter to see which agents called its tools after the change.

Next stepsCopy Anchor Link

You can now see every change a server makes to its tools, compare it with what you approved, and stop a tool you no longer trust. Next, make sure a changed tool can't write where it shouldn't.

• Tool labels – keep risky tools behind label-based rules
• Control MCP tool access – deny a tool, or allow only read-only ones