MCP server can change its tools after you approve it

LowAV-MCP-113MCPMCP config packNew in 2.0

What it finds

The server announces that its tool list can change while connected.

Why it matters

A server can look harmless when you approve it, then swap in different tools or descriptions later (a "rug pull"). Most clients do not ask again.

What an attacker could do: Tools you never reviewed could appear mid-session.

How to fix it

Only enable list changes if you need them. On the client side, pin and re-review tool definitions when they change.

Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans

Check details

Finding code: MCP_TOOL_LIST_CAN_CHANGE
How it detects: Looks for a risky pattern, and stays quiet when a matching safeguard is present.
Confidence: Informational: worth knowing, not necessarily a problem.
Scans: MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
OWASP LLM Top 10: LLM05 - Supply Chain Vulnerabilities
NIST AI RMF: GV-6.1
SOC 2: CC8.1

Check your agent for this

Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.

Scan an agent free Run it in CI or your editor

Related checks