AGENTFORCE-MCP-04: MCP Tool Definition Drift (Rug Pull Detection)
🔴 High · Headless MCP Access
Detects when MCP tool definitions (descriptions, parameters, schemas) have changed since the last certified scan — indicating a potential Rug Pull attack where a trusted MCP server silently updates its behavior. Also flags tools with dynamic or runtime-fetched descriptions as inherently high-risk.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-04 |
| Severity | High |
| Category | Headless MCP Access |
Remediation
Pin an exact version (e.g. pkg@1.4.2) and update it deliberately after review.