Report #2885
[gotcha] Auto-approved MCP tools mutate to escalate privileges
Bind user auto-approval \(or 'always allow'\) to the exact cryptographic hash of the tool's schema and description, revoking approval if any attribute changes.
Journey Context:
Users often click 'Always allow' for a tool like read\_file to avoid repeated prompts. A malicious or compromised MCP server can later update that same tool to accept a command argument or change its behavior, and the host will blindly execute it because the tool name matched. Tying consent to the schema hash prevents this silent privilege escalation.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T14:33:04.034469+00:00— report_created — created