Tool Manifest Integrity (Rug-Pull Defense)
Ensuring an agent's registered tool definitions (name, description, parameter schema) haven't silently changed since a client/operator trusted them — via hashing/pinning at registration, diff-based review, and behavioral baselines — since authentication and schema validation don't catch a tool whose meaning has drifted.
Also known as: manifest pinning, rug-pull attack, tool definition drift, capability attestation, semantic integrity, tool redefinition attack, schema drift
Part of: Agent Security
How authors use it
Oldest first (extraction date when no publication date is known).
| Author | Their term | Their meaning |
|---|---|---|
| Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway Nik Kale · 2026-07-29 | Manifest pinning | Hashing a tool's canonicalized name/description/parameter schema at registration, storing it as a signed baseline, and re-checking the hash on every reconnect or update, with a diff classifier routing material changes to human review. |
| Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway Nik Kale · 2026-07-29 | Semantic integrity | Whether a tool's meaning — what it actually does when invoked — is unchanged from when trust was granted, as opposed to whether a request is syntactically well-formed, schema-valid, or authenticated. |
Documents (2)
- Zero to Agent in 30 Minutes: Build a Supply Chain for Agent Context with Maxim Salnikov Michelle Smith · 2026-09-08 source ↗ Reader 🖥️
Because agent skills, instructions, hooks, and other customizations now spread across machines, harnesses, and codebases with no record of their origin or whether they've changed, teams should manage agent context the way modern software already manages code dependencies — versioned, pinned, sourced from a vetted registry, and audited for drift in CI — using a purpose-built package-manager tool (APM) rather than ad hoc installation. - Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway Nik Kale · 2026-07-29 source ↗ Reader 🖥️
Production MCP deployments need enforcement distributed across four distinct architectural layers — safe tool execution, an isolated management plane, a bounded outbound trust boundary, and pinned/monitored semantic integrity — each with its own earliest trustworthy enforcement point, because an API gateway can authenticate and authorize traffic but cannot safely execute tool logic, isolate management-plane infrastructure, contain a server's own outbound calls, or detect that a previously-trusted tool definition has changed.
Propositions touching this concept (3)
By publication month, oldest first (extraction month when no publication date is known).
2026-07
- explicitMCP security should be addressed as four separate control layers — execution, management infrastructure, outbound trust, and semantic integrity — each needing its own enforcement point, rather than as a single protocol feature or a single gateway.
- explicitA staggered four-week rollout — management plane, then execution, then outbound trust, then semantic integrity — is preferable to enforcing all four controls simultaneously, ordered from mature/easy-to-verify controls toward MCP-specific ones.
- explicitBehavioral monitoring (endpoints accessed, data moved, latency) paired with static manifest pinning is more powerful than either mechanism alone, because a schema-valid, authenticated request can still be dangerous if a tool's meaning has drifted since approval.
Open gaps (7)
- incompleteWriteGuard is explicitly scoped to authentication/authorization/audit of write actions via risk tiers, but nothing addresses semantic or manifest integrity — e.g., a tool could be silently redefined (a 'rug-pull') to keep its declared risk tier while its actual behavior changes, defeating the tier-based gate without triggering any policy violation.Cloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers — read next: extract-kale-securing-mcp-production-defense-in-depth, which argues explicitly that a gateway should provide authentication, authorization, and audit but should not be expected to detect semantic abuse like tool redefinition — WriteGuard is a real-world instance of exactly that division of labor, gap included.
- incompleteDash is described as preserving 'existing access control policies' and using 'permission-aware retrieval, encryption, and audit logging,' but nothing is said about protecting the MCP layer itself — manifest integrity, egress control on retrieved sensitive documents, or command-injection risk in how retrieved context is passed into an LLM context window. Dash is injecting an org's own threat models and security requirements into a code-review agent's context — arguably the highest-value target for exactly the injection/exfiltration/tool-manifest-drift classes of attack a rigorous MCP-security treatment would flag, and this piece is silent on all of them.Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review — read next: This corpus's own extraction of Kale's 'Securing MCP in Production' (extract-kale-securing-mcp-production-defense-in-depth.json), which catalogs exactly the execution/egress/manifest-integrity controls a system like this would need.
- incompleteThe diff classifier that separates 'cosmetic' from 'material' manifest changes is presented as the solution to alert fatigue and rubber-stamping, but its own false-negative rate — a material, malicious redefinition misclassified as cosmetic and auto-approved without ever reaching human review — is never examined, even though this is exactly the failure mode that would silently defeat manifest pinning's central promise.Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: Literature on classifier-gated security controls and their own adversarial robustness; compare against the structurally identical anomaly-gating false-negative problem already flagged elsewhere in this corpus for a pre-filter in front of an LLM-driven SOC pipeline.
- uninformedThe headline vulnerability statistics (Adversa AI: 38% of scanned servers had no authentication on critical endpoints, 43% were vulnerable to command execution) are cited without any account of sampling methodology — which registries were scanned, whether internet-exposed servers were selectively discoverable (a bias toward the least secure population), or how 'critical endpoint' was defined.Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: Adversa AI's underlying report methodology; cross-check against the independently-sourced 43%-auth-flaw / 33%-unrestricted-network-access figures already in extract-mcp-api-sprawl#p4 for consistency or divergence in sampling.
- incompleteThe four-week rollout sequences layers by ease-of-verification but never addresses interaction effects during the rollout window itself — e.g., whether leaving Layer 4 (manifest pinning) unpinned through weeks 1-3 lets an attacker redefine a tool to bypass the newly-hardened Layer 1 and Layer 3 controls before pinning goes live in week 4, which would undermine the staggered approach's safety during its own transition period.Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: No pointer given by the author; would need practitioner accounts of partial-rollout security posture or a formal ordering/interaction analysis across the four layers.
- incompleteThe article assumes step 5's vetting process — building "your very own enterprise repository of the customizations you've identified as safe to use" — is tractable, but never describes what that review actually checks or who performs it, unlike the fully mechanical steps (pin, lock, audit) that get concrete commands and behaviors. The hardest step in the whole pipeline is also the least specified.Zero to Agent in 30 Minutes: Build a Supply Chain for Agent Context with Maxim Salnikov — read next: The OpenClaw malicious-skills incident data (extract-openclaw-malicious-skills-incident-1368) for what a real-world skill-review process would need to catch; emerging agent-skill security-scanning services for candidate criteria.
- incompletePinning and hashing protect against a skill's files changing after installation, but nothing in the described workflow addresses semantic or behavioral drift within a single, unchanged, correctly-hashed version — a skill's prose can mislead or underperform an agent even when its hash exactly matches what was originally reviewed. Hash-based integrity is necessary but not sufficient for trusting what a pinned skill actually gets an agent to do.Zero to Agent in 30 Minutes: Build a Supply Chain for Agent Context with Maxim Salnikov — read next: extract-kale-securing-mcp-production-defense-in-depth's argument (p9) that behavioral monitoring paired with static manifest pinning is more powerful than either alone applies just as directly to agent skills as to MCP tool manifests.