What is MCP rug pull?

No formal specification defines a rug pull for MCP. The only primary description found here is a short mention in the OWASP MCP Top 10, an OWASP project that was still in an early draft version when fetched. OWASP lists rug pulls, meaning malicious updates to trusted tools, as one sub-technique of tool poisoning, alongside schema poisoning and tool shadowing.

The idea is a change that happens after trust is given. A tool is accepted at one point and later behaves differently, so an approval given once says nothing certain about what the tool will do next. The risk is therefore tied to time: the same tool name can carry different behavior on different days.

The related OWASP guidance on tool poisoning adds that agents should not act on schema changes without revalidation, and that schema hashes should be verified and logged. That is the practical defense the source points to. This entry makes no claim about how the MCP specification itself treats the term, and readers who need that should consult the specification directly.