Mutable Tool Manifests

MCP clients trust tool metadata fetched at runtime and do not detect changes after initial approval.

Impact

Enables rug-pull attacks where a benign tool turns malicious after users approve it.

Why this severity

Impact High × Likelihood High = Critical

Impact high: approved tools turn malicious. Likelihood high: the Postmark MCP server shipped clean versions, then added a hidden BCC in an update (2025 incident).

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: Poisoned Postmark MCP Server Email Exfiltration (MITRE ATLAS case study AML.CS0053, 2025)

Exploited by

MCP Tool Description Poisoning Threat · Critical severity

Mitigated by

Tool Manifest Pinning & Review Guardrail · Fixes critical risks

Remediation

Hash tool definitions at approval and compare on every session.
Prompt for re-consent when a manifest changes.
Prefer servers distributed through a vetted internal registry.

How to verify

Manifest drift test triggers re-approval UI.
Client logs record manifest hashes per session.

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM03:2025 Supply Chain

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities

MITRE ATLAS

AML.T0110 AI Agent Tool Poisoning

NIST AI RMF 1.0

MANAGE 3.1 Third-party AI risks are monitored and controls applied