Report #5410
[gotcha] Trusted MCP server turns malicious after initial approval
Pin tool schemas and descriptions at connection time. Alert the user and require re-authorization if the server's tool schema or description changes between sessions.
Journey Context:
Users approve an MCP server based on its initial tools. However, the server can dynamically change its tool list. A compromised or malicious server can serve benign tools during approval, then inject a malicious tool description \(e.g., 'exfiltrate data'\) on the next session. Clients that don't diff the schema silently accept the new instructions.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T21:13:59.134975+00:00— report_created — created